snapshot of https://github.com/seaweedfs/seaweedfs.git (master, 2026-09-16; blobs > 131072B omitted)

weed/admin/handlers/admin_handlers.go

@@ -0,0 +1,605 @@
+package handlers
+
+import (
+	"net/http"
+	"net/url"
+	"strconv"
+	"time"
+
+	"github.com/gorilla/mux"
+	"github.com/gorilla/sessions"
+	"github.com/prometheus/client_golang/prometheus/promhttp"
+	"github.com/seaweedfs/seaweedfs/weed/admin/dash"
+	"github.com/seaweedfs/seaweedfs/weed/admin/view/app"
+	"github.com/seaweedfs/seaweedfs/weed/admin/view/layout"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3tables"
+	"github.com/seaweedfs/seaweedfs/weed/stats"
+)
+
+// AdminHandlers contains all the HTTP handlers for the admin interface
+type AdminHandlers struct {
+	adminServer            *dash.AdminServer
+	sessionStore           sessions.Store
+	authHandlers           *AuthHandlers
+	clusterHandlers        *ClusterHandlers
+	fileBrowserHandlers    *FileBrowserHandlers
+	userHandlers           *UserHandlers
+	policyHandlers         *PolicyHandlers
+	pluginHandlers         *PluginHandlers
+	mqHandlers             *MessageQueueHandlers
+	serviceAccountHandlers *ServiceAccountHandlers
+	groupHandlers          *GroupHandlers
+}
+
+// NewAdminHandlers creates a new instance of AdminHandlers
+func NewAdminHandlers(adminServer *dash.AdminServer, store sessions.Store) *AdminHandlers {
+	authHandlers := NewAuthHandlers(adminServer, store)
+	clusterHandlers := NewClusterHandlers(adminServer)
+	fileBrowserHandlers := NewFileBrowserHandlers(adminServer)
+	userHandlers := NewUserHandlers(adminServer)
+	policyHandlers := NewPolicyHandlers(adminServer)
+	pluginHandlers := NewPluginHandlers(adminServer)
+	mqHandlers := NewMessageQueueHandlers(adminServer)
+	serviceAccountHandlers := NewServiceAccountHandlers(adminServer)
+	groupHandlers := NewGroupHandlers(adminServer)
+	return &AdminHandlers{
+		adminServer:            adminServer,
+		sessionStore:           store,
+		authHandlers:           authHandlers,
+		clusterHandlers:        clusterHandlers,
+		fileBrowserHandlers:    fileBrowserHandlers,
+		userHandlers:           userHandlers,
+		policyHandlers:         policyHandlers,
+		pluginHandlers:         pluginHandlers,
+		mqHandlers:             mqHandlers,
+		serviceAccountHandlers: serviceAccountHandlers,
+		groupHandlers:          groupHandlers,
+	}
+}
+
+// SetupRoutes configures all the routes for the admin interface
+func (h *AdminHandlers) SetupRoutes(r *mux.Router, authRequired bool, adminUser, adminPassword, readOnlyUser, readOnlyPassword string, enableUI bool) {
+	// Health check (no auth required)
+	r.HandleFunc("/health", h.HealthCheck).Methods(http.MethodGet)
+
+	// Prometheus metrics endpoint (no auth required)
+	r.Handle("/metrics", promhttp.HandlerFor(stats.Gather, promhttp.HandlerOpts{})).Methods(http.MethodGet)
+
+	// Favicon route (no auth required) - redirect to static version
+	r.HandleFunc("/favicon.ico", func(w http.ResponseWriter, req *http.Request) {
+		http.Redirect(w, req, dash.P(req.Context(), "/static/favicon.ico"), http.StatusMovedPermanently)
+	}).Methods(http.MethodGet)
+
+	// Skip UI routes if UI is not enabled
+	if !enableUI {
+		return
+	}
+
+	if authRequired {
+		// Authentication routes (no auth required)
+		r.HandleFunc("/login", h.authHandlers.ShowLogin).Methods(http.MethodGet)
+		r.Handle("/login", h.authHandlers.HandleLogin(adminUser, adminPassword, readOnlyUser, readOnlyPassword)).Methods(http.MethodPost)
+		r.HandleFunc("/logout", h.authHandlers.HandleLogout).Methods(http.MethodGet)
+
+		protected := r.NewRoute().Subrouter()
+		protected.Use(dash.RequireAuth(h.sessionStore))
+		h.registerUIRoutes(protected)
+
+		api := r.PathPrefix("/api").Subrouter()
+		api.Use(dash.RequireAuthAPI(h.sessionStore))
+		h.registerAPIRoutes(api, true)
+		return
+	}
+
+	// No authentication required - all routes are public
+	h.registerUIRoutes(r)
+	api := r.PathPrefix("/api").Subrouter()
+	h.registerAPIRoutes(api, false)
+}
+
+func (h *AdminHandlers) registerUIRoutes(r *mux.Router) {
+	// Main admin interface routes
+	r.HandleFunc("/", h.ShowDashboard).Methods(http.MethodGet)
+	r.HandleFunc("/admin", h.ShowDashboard).Methods(http.MethodGet)
+
+	// Object Store management routes
+	r.HandleFunc("/object-store/buckets", h.ShowS3Buckets).Methods(http.MethodGet)
+	r.HandleFunc("/object-store/buckets/{bucket}", h.ShowBucketDetails).Methods(http.MethodGet)
+	r.HandleFunc("/object-store/users", h.userHandlers.ShowObjectStoreUsers).Methods(http.MethodGet)
+	r.HandleFunc("/object-store/policies", h.policyHandlers.ShowPolicies).Methods(http.MethodGet)
+	r.HandleFunc("/object-store/groups", h.groupHandlers.ShowGroups).Methods(http.MethodGet)
+	r.HandleFunc("/object-store/service-accounts", h.serviceAccountHandlers.ShowServiceAccounts).Methods(http.MethodGet)
+	r.HandleFunc("/object-store/s3tables/buckets", h.ShowS3TablesBuckets).Methods(http.MethodGet)
+	r.HandleFunc("/object-store/s3tables/buckets/{bucket}/namespaces", h.ShowS3TablesNamespaces).Methods(http.MethodGet)
+	r.HandleFunc("/object-store/s3tables/buckets/{bucket}/namespaces/{namespace}/tables", h.ShowS3TablesTables).Methods(http.MethodGet)
+	r.HandleFunc("/object-store/s3tables/buckets/{bucket}/namespaces/{namespace}/tables/{table}", h.ShowS3TablesTableDetails).Methods(http.MethodGet)
+	r.HandleFunc("/object-store/s3tables/buckets/{bucket}/namespaces/{namespace}/tables/{table}/data", h.ShowS3TablesTableData).Methods(http.MethodGet)
+	r.HandleFunc("/object-store/iceberg", h.ShowIcebergCatalog).Methods(http.MethodGet)
+	r.HandleFunc("/object-store/iceberg/{catalog}/namespaces", h.ShowIcebergNamespaces).Methods(http.MethodGet)
+	r.HandleFunc("/object-store/iceberg/{catalog}/namespaces/{namespace}/tables", h.ShowIcebergTables).Methods(http.MethodGet)
+	r.HandleFunc("/object-store/iceberg/{catalog}/namespaces/{namespace}/tables/{table}", h.ShowIcebergTableDetails).Methods(http.MethodGet)
+
+	// File browser routes
+	r.HandleFunc("/files", h.fileBrowserHandlers.ShowFileBrowser).Methods(http.MethodGet)
+
+	// Cluster management routes
+	r.HandleFunc("/cluster/masters", h.clusterHandlers.ShowClusterMasters).Methods(http.MethodGet)
+	r.HandleFunc("/cluster/filers", h.clusterHandlers.ShowClusterFilers).Methods(http.MethodGet)
+	r.HandleFunc("/cluster/s3", h.clusterHandlers.ShowClusterS3Servers).Methods(http.MethodGet)
+	r.HandleFunc("/cluster/volume-servers", h.clusterHandlers.ShowClusterVolumeServers).Methods(http.MethodGet)
+	r.HandleFunc("/cluster/mount-clients", h.clusterHandlers.ShowMountClients).Methods(http.MethodGet)
+
+	// Storage management routes
+	r.HandleFunc("/storage/volumes", h.clusterHandlers.ShowClusterVolumes).Methods(http.MethodGet)
+	r.HandleFunc("/storage/volumes/{id}/{server}", h.clusterHandlers.ShowVolumeDetails).Methods(http.MethodGet)
+	r.HandleFunc("/storage/collections", h.clusterHandlers.ShowClusterCollections).Methods(http.MethodGet)
+	r.HandleFunc("/storage/collections/{name}", h.clusterHandlers.ShowCollectionDetails).Methods(http.MethodGet)
+	r.HandleFunc("/storage/ec-shards", h.clusterHandlers.ShowClusterEcShards).Methods(http.MethodGet)
+	r.HandleFunc("/storage/ec-volumes/{id}", h.clusterHandlers.ShowEcVolumeDetails).Methods(http.MethodGet)
+
+	// Message Queue management routes
+	r.HandleFunc("/mq/brokers", h.mqHandlers.ShowBrokers).Methods(http.MethodGet)
+	r.HandleFunc("/mq/topics", h.mqHandlers.ShowTopics).Methods(http.MethodGet)
+	r.HandleFunc("/mq/topics/{namespace}/{topic}", h.mqHandlers.ShowTopicDetails).Methods(http.MethodGet)
+
+	// Plugin pages
+	r.HandleFunc("/plugin", h.pluginHandlers.ShowPlugin).Methods(http.MethodGet)
+	r.HandleFunc("/plugin/configuration", h.pluginHandlers.ShowPluginConfiguration).Methods(http.MethodGet)
+	r.HandleFunc("/plugin/queue", h.pluginHandlers.ShowPluginQueue).Methods(http.MethodGet)
+	r.HandleFunc("/plugin/detection", h.pluginHandlers.ShowPluginDetection).Methods(http.MethodGet)
+	r.HandleFunc("/plugin/execution", h.pluginHandlers.ShowPluginExecution).Methods(http.MethodGet)
+	r.HandleFunc("/plugin/monitoring", h.pluginHandlers.ShowPluginMonitoring).Methods(http.MethodGet)
+	r.HandleFunc("/plugin/lanes/{lane}", h.pluginHandlers.ShowPluginLane).Methods(http.MethodGet)
+	r.HandleFunc("/plugin/lanes/{lane}/configuration", h.pluginHandlers.ShowPluginLaneConfiguration).Methods(http.MethodGet)
+	r.HandleFunc("/plugin/lanes/{lane}/queue", h.pluginHandlers.ShowPluginLaneQueue).Methods(http.MethodGet)
+	r.HandleFunc("/plugin/lanes/{lane}/detection", h.pluginHandlers.ShowPluginLaneDetection).Methods(http.MethodGet)
+	r.HandleFunc("/plugin/lanes/{lane}/execution", h.pluginHandlers.ShowPluginLaneExecution).Methods(http.MethodGet)
+	r.HandleFunc("/plugin/lanes/{lane}/monitoring", h.pluginHandlers.ShowPluginLaneMonitoring).Methods(http.MethodGet)
+	r.HandleFunc("/plugin/lanes/{lane}/workers", h.pluginHandlers.ShowPluginLaneWorkers).Methods(http.MethodGet)
+}
+
+func (h *AdminHandlers) registerAPIRoutes(api *mux.Router, enforceWrite bool) {
+	wrapWrite := func(handler http.HandlerFunc) http.Handler {
+		if !enforceWrite {
+			return handler
+		}
+		return dash.RequireWriteAccess()(handler)
+	}
+
+	api.HandleFunc("/cluster/topology", h.clusterHandlers.GetClusterTopology).Methods(http.MethodGet)
+	api.HandleFunc("/cluster/masters", h.clusterHandlers.GetMasters).Methods(http.MethodGet)
+	api.HandleFunc("/cluster/volumes", h.clusterHandlers.GetVolumeServers).Methods(http.MethodGet)
+	api.HandleFunc("/admin", h.adminServer.ShowAdmin).Methods(http.MethodGet)
+	api.HandleFunc("/config", h.adminServer.GetConfigInfo).Methods(http.MethodGet)
+
+	s3Api := api.PathPrefix("/s3").Subrouter()
+	s3Api.HandleFunc("/buckets", h.adminServer.ListBucketsAPI).Methods(http.MethodGet)
+	s3Api.Handle("/buckets", wrapWrite(h.adminServer.CreateBucket)).Methods(http.MethodPost)
+	s3Api.Handle("/buckets/{bucket}", wrapWrite(h.adminServer.DeleteBucket)).Methods(http.MethodDelete)
+	s3Api.HandleFunc("/buckets/{bucket}", h.adminServer.ShowBucketDetails).Methods(http.MethodGet)
+	s3Api.HandleFunc("/buckets/{bucket}/lifecycle", h.adminServer.ShowBucketLifecycle).Methods(http.MethodGet)
+	s3Api.Handle("/buckets/{bucket}/lifecycle", wrapWrite(h.adminServer.UpdateBucketLifecycle)).Methods(http.MethodPut)
+	s3Api.Handle("/buckets/{bucket}/lifecycle", wrapWrite(h.adminServer.DeleteBucketLifecycle)).Methods(http.MethodDelete)
+	s3Api.Handle("/buckets/{bucket}/quota", wrapWrite(h.adminServer.UpdateBucketQuota)).Methods(http.MethodPut)
+	s3Api.Handle("/buckets/{bucket}/owner", wrapWrite(h.adminServer.UpdateBucketOwner)).Methods(http.MethodPut)
+	s3Api.HandleFunc("/buckets/{bucket}/policy", h.adminServer.ShowBucketPolicy).Methods(http.MethodGet)
+	s3Api.Handle("/buckets/{bucket}/policy", wrapWrite(h.adminServer.UpdateBucketPolicy)).Methods(http.MethodPut)
+	s3Api.Handle("/buckets/{bucket}/policy", wrapWrite(h.adminServer.RemoveBucketPolicy)).Methods(http.MethodDelete)
+
+	usersApi := api.PathPrefix("/users").Subrouter()
+	usersApi.HandleFunc("", h.userHandlers.GetUsers).Methods(http.MethodGet)
+	usersApi.Handle("", wrapWrite(h.userHandlers.CreateUser)).Methods(http.MethodPost)
+	usersApi.HandleFunc("/{username}", h.userHandlers.GetUserDetails).Methods(http.MethodGet)
+	usersApi.Handle("/{username}", wrapWrite(h.userHandlers.UpdateUser)).Methods(http.MethodPut)
+	usersApi.Handle("/{username}", wrapWrite(h.userHandlers.DeleteUser)).Methods(http.MethodDelete)
+	usersApi.Handle("/{username}/access-keys", wrapWrite(h.userHandlers.CreateAccessKey)).Methods(http.MethodPost)
+	usersApi.Handle("/{username}/access-keys/{accessKeyId}", wrapWrite(h.userHandlers.DeleteAccessKey)).Methods(http.MethodDelete)
+	usersApi.Handle("/{username}/access-keys/{accessKeyId}/status", wrapWrite(h.userHandlers.UpdateAccessKeyStatus)).Methods(http.MethodPut)
+	usersApi.HandleFunc("/{username}/policies", h.userHandlers.GetUserPolicies).Methods(http.MethodGet)
+	usersApi.Handle("/{username}/policies", wrapWrite(h.userHandlers.UpdateUserPolicies)).Methods(http.MethodPut)
+
+	saApi := api.PathPrefix("/service-accounts").Subrouter()
+	saApi.HandleFunc("", h.serviceAccountHandlers.GetServiceAccounts).Methods(http.MethodGet)
+	saApi.Handle("", wrapWrite(h.serviceAccountHandlers.CreateServiceAccount)).Methods(http.MethodPost)
+	saApi.HandleFunc("/{id}", h.serviceAccountHandlers.GetServiceAccountDetails).Methods(http.MethodGet)
+	saApi.Handle("/{id}", wrapWrite(h.serviceAccountHandlers.UpdateServiceAccount)).Methods(http.MethodPut)
+	saApi.Handle("/{id}", wrapWrite(h.serviceAccountHandlers.DeleteServiceAccount)).Methods(http.MethodDelete)
+
+	groupsApi := api.PathPrefix("/groups").Subrouter()
+	groupsApi.HandleFunc("", h.groupHandlers.GetGroups).Methods(http.MethodGet)
+	groupsApi.Handle("", wrapWrite(h.groupHandlers.CreateGroup)).Methods(http.MethodPost)
+	groupsApi.HandleFunc("/{name}", h.groupHandlers.GetGroupDetails).Methods(http.MethodGet)
+	groupsApi.Handle("/{name}", wrapWrite(h.groupHandlers.DeleteGroup)).Methods(http.MethodDelete)
+	groupsApi.Handle("/{name}/status", wrapWrite(h.groupHandlers.SetGroupStatus)).Methods(http.MethodPut)
+	groupsApi.HandleFunc("/{name}/members", h.groupHandlers.GetGroupMembers).Methods(http.MethodGet)
+	groupsApi.Handle("/{name}/members", wrapWrite(h.groupHandlers.AddGroupMember)).Methods(http.MethodPost)
+	groupsApi.Handle("/{name}/members/{username}", wrapWrite(h.groupHandlers.RemoveGroupMember)).Methods(http.MethodDelete)
+	groupsApi.HandleFunc("/{name}/policies", h.groupHandlers.GetGroupPolicies).Methods(http.MethodGet)
+	groupsApi.Handle("/{name}/policies", wrapWrite(h.groupHandlers.AttachGroupPolicy)).Methods(http.MethodPost)
+	groupsApi.Handle("/{name}/policies/{policyName}", wrapWrite(h.groupHandlers.DetachGroupPolicy)).Methods(http.MethodDelete)
+
+	policyApi := api.PathPrefix("/object-store/policies").Subrouter()
+	policyApi.HandleFunc("", h.policyHandlers.GetPolicies).Methods(http.MethodGet)
+	policyApi.Handle("", wrapWrite(h.policyHandlers.CreatePolicy)).Methods(http.MethodPost)
+	policyApi.HandleFunc("/{name}", h.policyHandlers.GetPolicy).Methods(http.MethodGet)
+	policyApi.Handle("/{name}", wrapWrite(h.policyHandlers.UpdatePolicy)).Methods(http.MethodPut)
+	policyApi.Handle("/{name}", wrapWrite(h.policyHandlers.DeletePolicy)).Methods(http.MethodDelete)
+	policyApi.HandleFunc("/validate", h.policyHandlers.ValidatePolicy).Methods(http.MethodPost)
+
+	// Registered at the API root, not under policyApi: policyApi's "/{name}"
+	// GET route would shadow any single-segment GET route registered after it.
+	api.HandleFunc("/principals", h.policyHandlers.GetPrincipalSuggestions).Methods(http.MethodGet)
+
+	s3TablesApi := api.PathPrefix("/s3tables").Subrouter()
+	s3TablesApi.HandleFunc("/buckets", h.adminServer.ListS3TablesBucketsAPI).Methods(http.MethodGet)
+	s3TablesApi.Handle("/buckets", wrapWrite(h.adminServer.CreateS3TablesBucket)).Methods(http.MethodPost)
+	s3TablesApi.Handle("/buckets", wrapWrite(h.adminServer.DeleteS3TablesBucket)).Methods(http.MethodDelete)
+	s3TablesApi.HandleFunc("/namespaces", h.adminServer.ListS3TablesNamespacesAPI).Methods(http.MethodGet)
+	s3TablesApi.Handle("/namespaces", wrapWrite(h.adminServer.CreateS3TablesNamespace)).Methods(http.MethodPost)
+	s3TablesApi.Handle("/namespaces", wrapWrite(h.adminServer.DeleteS3TablesNamespace)).Methods(http.MethodDelete)
+	s3TablesApi.HandleFunc("/tables", h.adminServer.ListS3TablesTablesAPI).Methods(http.MethodGet)
+	s3TablesApi.Handle("/tables", wrapWrite(h.adminServer.CreateS3TablesTable)).Methods(http.MethodPost)
+	s3TablesApi.Handle("/tables", wrapWrite(h.adminServer.DeleteS3TablesTable)).Methods(http.MethodDelete)
+	s3TablesApi.Handle("/bucket-policy", wrapWrite(h.adminServer.PutS3TablesBucketPolicy)).Methods(http.MethodPut)
+	s3TablesApi.HandleFunc("/bucket-policy", h.adminServer.GetS3TablesBucketPolicy).Methods(http.MethodGet)
+	s3TablesApi.Handle("/bucket-policy", wrapWrite(h.adminServer.DeleteS3TablesBucketPolicy)).Methods(http.MethodDelete)
+	s3TablesApi.Handle("/table-policy", wrapWrite(h.adminServer.PutS3TablesTablePolicy)).Methods(http.MethodPut)
+	s3TablesApi.HandleFunc("/table-policy", h.adminServer.GetS3TablesTablePolicy).Methods(http.MethodGet)
+	s3TablesApi.Handle("/table-policy", wrapWrite(h.adminServer.DeleteS3TablesTablePolicy)).Methods(http.MethodDelete)
+	s3TablesApi.Handle("/tags", wrapWrite(h.adminServer.TagS3TablesResource)).Methods(http.MethodPut)
+	s3TablesApi.HandleFunc("/tags", h.adminServer.ListS3TablesTags).Methods(http.MethodGet)
+	s3TablesApi.Handle("/tags", wrapWrite(h.adminServer.UntagS3TablesResource)).Methods(http.MethodDelete)
+
+	filesApi := api.PathPrefix("/files").Subrouter()
+	filesApi.Handle("/delete", wrapWrite(h.fileBrowserHandlers.DeleteFile)).Methods(http.MethodDelete)
+	filesApi.Handle("/delete-multiple", wrapWrite(h.fileBrowserHandlers.DeleteMultipleFiles)).Methods(http.MethodDelete)
+	filesApi.Handle("/create-folder", wrapWrite(h.fileBrowserHandlers.CreateFolder)).Methods(http.MethodPost)
+	filesApi.Handle("/upload", wrapWrite(h.fileBrowserHandlers.UploadFile)).Methods(http.MethodPost)
+	filesApi.HandleFunc("/download", h.fileBrowserHandlers.DownloadFile).Methods(http.MethodGet)
+	filesApi.HandleFunc("/view", h.fileBrowserHandlers.ViewFile).Methods(http.MethodGet)
+	filesApi.HandleFunc("/properties", h.fileBrowserHandlers.GetFileProperties).Methods(http.MethodGet)
+	filesApi.HandleFunc("/metadata", h.fileBrowserHandlers.ExportMetadata).Methods(http.MethodGet)
+	filesApi.HandleFunc("/list-folders", h.fileBrowserHandlers.ListFolders).Methods(http.MethodGet)
+
+	volumeApi := api.PathPrefix("/volumes").Subrouter()
+	volumeApi.HandleFunc("/export", h.clusterHandlers.ExportClusterVolumes).Methods(http.MethodGet)
+	volumeApi.Handle("/{id}/{server}/vacuum", wrapWrite(h.clusterHandlers.VacuumVolume)).Methods(http.MethodPost)
+	volumeApi.Handle("/{id}/{server}/read-only", wrapWrite(h.clusterHandlers.SetVolumeReadOnly)).Methods(http.MethodPost)
+
+	pluginApi := api.PathPrefix("/plugin").Subrouter()
+	pluginApi.HandleFunc("/status", h.adminServer.GetPluginStatusAPI).Methods(http.MethodGet)
+	pluginApi.HandleFunc("/lanes", h.adminServer.GetPluginLanesAPI).Methods(http.MethodGet)
+	pluginApi.HandleFunc("/workers", h.adminServer.GetPluginWorkersAPI).Methods(http.MethodGet)
+	pluginApi.HandleFunc("/job-types", h.adminServer.GetPluginJobTypesAPI).Methods(http.MethodGet)
+	pluginApi.HandleFunc("/jobs", h.adminServer.GetPluginJobsAPI).Methods(http.MethodGet)
+	pluginApi.HandleFunc("/jobs/{jobId}", h.adminServer.GetPluginJobAPI).Methods(http.MethodGet)
+	pluginApi.HandleFunc("/jobs/{jobId}/detail", h.adminServer.GetPluginJobDetailAPI).Methods(http.MethodGet)
+	pluginApi.HandleFunc("/activities", h.adminServer.GetPluginActivitiesAPI).Methods(http.MethodGet)
+	pluginApi.HandleFunc("/scheduler-states", h.adminServer.GetPluginSchedulerStatesAPI).Methods(http.MethodGet)
+	pluginApi.HandleFunc("/observations", h.adminServer.GetPluginObservationsAPI).Methods(http.MethodGet)
+	pluginApi.HandleFunc("/scheduler-status", h.adminServer.GetPluginSchedulerStatusAPI).Methods(http.MethodGet)
+	pluginApi.HandleFunc("/job-types/{jobType}/descriptor", h.adminServer.GetPluginJobTypeDescriptorAPI).Methods(http.MethodGet)
+	pluginApi.HandleFunc("/job-types/{jobType}/schema", h.adminServer.RequestPluginJobTypeSchemaAPI).Methods(http.MethodPost)
+	pluginApi.HandleFunc("/job-types/{jobType}/config", h.adminServer.GetPluginJobTypeConfigAPI).Methods(http.MethodGet)
+	pluginApi.Handle("/job-types/{jobType}/config", wrapWrite(h.adminServer.UpdatePluginJobTypeConfigAPI)).Methods(http.MethodPut)
+	pluginApi.HandleFunc("/job-types/{jobType}/runs", h.adminServer.GetPluginRunHistoryAPI).Methods(http.MethodGet)
+	pluginApi.Handle("/job-types/{jobType}/detect", wrapWrite(h.adminServer.TriggerPluginDetectionAPI)).Methods(http.MethodPost)
+	pluginApi.Handle("/job-types/{jobType}/run", wrapWrite(h.adminServer.RunPluginJobTypeAPI)).Methods(http.MethodPost)
+	pluginApi.Handle("/jobs/execute", wrapWrite(h.adminServer.ExecutePluginJobAPI)).Methods(http.MethodPost)
+	pluginApi.Handle("/jobs/{jobId}/expire", wrapWrite(h.adminServer.ExpirePluginJobAPI)).Methods(http.MethodPost)
+
+	mqApi := api.PathPrefix("/mq").Subrouter()
+	mqApi.HandleFunc("/topics/{namespace}/{topic}", h.mqHandlers.GetTopicDetailsAPI).Methods(http.MethodGet)
+	mqApi.Handle("/topics/create", wrapWrite(h.mqHandlers.CreateTopicAPI)).Methods(http.MethodPost)
+	mqApi.Handle("/topics/retention/update", wrapWrite(h.mqHandlers.UpdateTopicRetentionAPI)).Methods(http.MethodPost)
+	mqApi.Handle("/retention/purge", wrapWrite(h.adminServer.TriggerTopicRetentionPurgeAPI)).Methods(http.MethodPost)
+}
+
+// HealthCheck returns the health status of the admin interface
+func (h *AdminHandlers) HealthCheck(w http.ResponseWriter, r *http.Request) {
+	writeJSON(w, http.StatusOK, map[string]string{"health": "ok"})
+}
+
+// ShowDashboard renders the main admin dashboard
+func (h *AdminHandlers) ShowDashboard(w http.ResponseWriter, r *http.Request) {
+	// Get admin data from the server
+	adminData := h.getAdminData(r)
+	username := h.getUsername(r)
+
+	// Render HTML template
+	w.Header().Set("Content-Type", "text/html")
+	adminComponent := app.Admin(adminData)
+	viewCtx := layout.NewViewContext(r, username, dash.CSRFTokenFromContext(r.Context()))
+	layoutComponent := layout.Layout(viewCtx, adminComponent)
+	if err := layoutComponent.Render(r.Context(), w); err != nil {
+		writeJSONError(w, http.StatusInternalServerError, "Failed to render template: "+err.Error())
+		return
+	}
+}
+
+// ShowS3Buckets renders the Object Store buckets management page
+func (h *AdminHandlers) ShowS3Buckets(w http.ResponseWriter, r *http.Request) {
+	// Get pagination and sorting parameters from query string
+	page := 1
+	if p := r.URL.Query().Get("page"); p != "" {
+		if parsed, err := strconv.Atoi(p); err == nil && parsed > 0 {
+			page = parsed
+		}
+	}
+
+	pageSize := 100
+	if ps := r.URL.Query().Get("pageSize"); ps != "" {
+		if parsed, err := strconv.Atoi(ps); err == nil && parsed > 0 && parsed <= 1000 {
+			pageSize = parsed
+		}
+	}
+
+	sortBy := defaultQuery(r.URL.Query().Get("sortBy"), "name")
+	sortOrder := defaultQuery(r.URL.Query().Get("sortOrder"), "asc")
+
+	// Get Object Store buckets data with pagination
+	s3Data := h.getS3BucketsData(r, page, pageSize, sortBy, sortOrder)
+	username := h.getUsername(r)
+
+	// Render HTML template
+	w.Header().Set("Content-Type", "text/html")
+	s3Component := app.S3Buckets(s3Data)
+	viewCtx := layout.NewViewContext(r, username, dash.CSRFTokenFromContext(r.Context()))
+	layoutComponent := layout.Layout(viewCtx, s3Component)
+	if err := layoutComponent.Render(r.Context(), w); err != nil {
+		writeJSONError(w, http.StatusInternalServerError, "Failed to render template: "+err.Error())
+		return
+	}
+}
+
+// ShowS3TablesBuckets renders the S3 Tables buckets page
+func (h *AdminHandlers) ShowS3TablesBuckets(w http.ResponseWriter, r *http.Request) {
+	username := h.getUsername(r)
+
+	data, err := h.adminServer.GetS3TablesBucketsData(r.Context())
+	if err != nil {
+		writeJSONError(w, http.StatusInternalServerError, "Failed to get S3 Tables buckets: "+err.Error())
+		return
+	}
+	data.Username = username
+
+	w.Header().Set("Content-Type", "text/html")
+	component := app.S3TablesBuckets(data)
+	viewCtx := layout.NewViewContext(r, username, dash.CSRFTokenFromContext(r.Context()))
+	layoutComponent := layout.Layout(viewCtx, component)
+	if err := layoutComponent.Render(r.Context(), w); err != nil {
+		writeJSONError(w, http.StatusInternalServerError, "Failed to render template: "+err.Error())
+	}
+}
+
+// ShowS3TablesNamespaces renders namespaces for a table bucket
+func (h *AdminHandlers) ShowS3TablesNamespaces(w http.ResponseWriter, r *http.Request) {
+	username := h.getUsername(r)
+
+	bucketName := mux.Vars(r)["bucket"]
+	arn, err := buildS3TablesBucketArn(bucketName)
+	if err != nil {
+		writeJSONError(w, http.StatusBadRequest, err.Error())
+		return
+	}
+
+	data, err := h.adminServer.GetS3TablesNamespacesData(r.Context(), arn)
+	if err != nil {
+		writeJSONError(w, http.StatusInternalServerError, "Failed to get S3 Tables namespaces: "+err.Error())
+		return
+	}
+	data.Username = username
+
+	w.Header().Set("Content-Type", "text/html")
+	component := app.S3TablesNamespaces(data)
+	viewCtx := layout.NewViewContext(r, username, dash.CSRFTokenFromContext(r.Context()))
+	layoutComponent := layout.Layout(viewCtx, component)
+	if err := layoutComponent.Render(r.Context(), w); err != nil {
+		writeJSONError(w, http.StatusInternalServerError, "Failed to render template: "+err.Error())
+	}
+}
+
+// ShowS3TablesTables renders tables for a namespace
+func (h *AdminHandlers) ShowS3TablesTables(w http.ResponseWriter, r *http.Request) {
+	username := h.getUsername(r)
+
+	bucketName := mux.Vars(r)["bucket"]
+	namespace := mux.Vars(r)["namespace"]
+	arn, err := buildS3TablesBucketArn(bucketName)
+	if err != nil {
+		writeJSONError(w, http.StatusBadRequest, err.Error())
+		return
+	}
+
+	data, err := h.adminServer.GetS3TablesTablesData(r.Context(), arn, namespace)
+	if err != nil {
+		writeJSONError(w, http.StatusInternalServerError, "Failed to get S3 Tables tables: "+err.Error())
+		return
+	}
+	data.Username = username
+
+	w.Header().Set("Content-Type", "text/html")
+	component := app.S3TablesTables(data)
+	viewCtx := layout.NewViewContext(r, username, dash.CSRFTokenFromContext(r.Context()))
+	layoutComponent := layout.Layout(viewCtx, component)
+	if err := layoutComponent.Render(r.Context(), w); err != nil {
+		writeJSONError(w, http.StatusInternalServerError, "Failed to render template: "+err.Error())
+	}
+}
+
+// ShowS3TablesTableDetails renders Iceberg table metadata and snapshot details on the merged S3 Tables path.
+func (h *AdminHandlers) ShowS3TablesTableDetails(w http.ResponseWriter, r *http.Request) {
+	bucketName := mux.Vars(r)["bucket"]
+	namespace := mux.Vars(r)["namespace"]
+	tableName := mux.Vars(r)["table"]
+	arn, err := buildS3TablesBucketArn(bucketName)
+	if err != nil {
+		writeJSONError(w, http.StatusBadRequest, err.Error())
+		return
+	}
+
+	username := h.getUsername(r)
+	data, err := h.adminServer.GetIcebergTableDetailsData(r.Context(), bucketName, arn, namespace, tableName)
+	if err != nil {
+		writeJSONError(w, http.StatusInternalServerError, "Failed to get table details: "+err.Error())
+		return
+	}
+	data.Username = username
+
+	w.Header().Set("Content-Type", "text/html")
+	component := app.IcebergTableDetails(data)
+	viewCtx := layout.NewViewContext(r, username, dash.CSRFTokenFromContext(r.Context()))
+	layoutComponent := layout.Layout(viewCtx, component)
+	if err := layoutComponent.Render(r.Context(), w); err != nil {
+		writeJSONError(w, http.StatusInternalServerError, "Failed to render template: "+err.Error())
+	}
+}
+
+// ShowS3TablesTableData renders sample rows and the data-file list of an Iceberg table snapshot.
+func (h *AdminHandlers) ShowS3TablesTableData(w http.ResponseWriter, r *http.Request) {
+	bucketName := mux.Vars(r)["bucket"]
+	namespace := mux.Vars(r)["namespace"]
+	tableName := mux.Vars(r)["table"]
+	arn, err := buildS3TablesBucketArn(bucketName)
+	if err != nil {
+		writeJSONError(w, http.StatusBadRequest, err.Error())
+		return
+	}
+
+	query := r.URL.Query()
+	snapshotID, _ := strconv.ParseInt(query.Get("snapshot"), 10, 64)
+	limit, _ := strconv.Atoi(query.Get("limit"))
+
+	username := h.getUsername(r)
+	data, err := h.adminServer.GetIcebergTableDataPreview(r.Context(), bucketName, arn, namespace, tableName, snapshotID, query.Get("file"), limit)
+	if err != nil {
+		writeJSONError(w, http.StatusInternalServerError, "Failed to get table data: "+err.Error())
+		return
+	}
+	data.Username = username
+
+	w.Header().Set("Content-Type", "text/html")
+	component := app.IcebergTableData(data)
+	viewCtx := layout.NewViewContext(r, username, dash.CSRFTokenFromContext(r.Context()))
+	layoutComponent := layout.Layout(viewCtx, component)
+	if err := layoutComponent.Render(r.Context(), w); err != nil {
+		writeJSONError(w, http.StatusInternalServerError, "Failed to render template: "+err.Error())
+	}
+}
+
+func buildS3TablesBucketArn(bucketName string) (string, error) {
+	return s3tables.BuildBucketARN(s3tables.DefaultRegion, s3_constants.AccountAdminId, bucketName)
+}
+
+// getUsername returns the username from context, defaulting to "admin" if not set
+func (h *AdminHandlers) getUsername(r *http.Request) string {
+	username := dash.UsernameFromContext(r.Context())
+	if username == "" {
+		username = "admin"
+	}
+	return username
+}
+
+// ShowIcebergCatalog redirects legacy Iceberg catalog URL to the merged S3 Tables buckets page.
+func (h *AdminHandlers) ShowIcebergCatalog(w http.ResponseWriter, r *http.Request) {
+	http.Redirect(w, r, dash.P(r.Context(), "/object-store/s3tables/buckets"), http.StatusMovedPermanently)
+}
+
+// ShowIcebergNamespaces redirects legacy Iceberg namespaces URL to the merged S3 Tables namespaces page.
+func (h *AdminHandlers) ShowIcebergNamespaces(w http.ResponseWriter, r *http.Request) {
+	catalogName := mux.Vars(r)["catalog"]
+	http.Redirect(w, r, dash.P(r.Context(), "/object-store/s3tables/buckets/"+url.PathEscape(catalogName)+"/namespaces"), http.StatusMovedPermanently)
+}
+
+// ShowIcebergTables redirects legacy Iceberg tables URL to the merged S3 Tables tables page.
+func (h *AdminHandlers) ShowIcebergTables(w http.ResponseWriter, r *http.Request) {
+	catalogName := mux.Vars(r)["catalog"]
+	namespace := mux.Vars(r)["namespace"]
+	http.Redirect(w, r, dash.P(r.Context(), "/object-store/s3tables/buckets/"+url.PathEscape(catalogName)+"/namespaces/"+url.PathEscape(namespace)+"/tables"), http.StatusMovedPermanently)
+}
+
+// ShowIcebergTableDetails redirects legacy Iceberg table details URL to the merged S3 Tables details page.
+func (h *AdminHandlers) ShowIcebergTableDetails(w http.ResponseWriter, r *http.Request) {
+	catalogName := mux.Vars(r)["catalog"]
+	namespace := mux.Vars(r)["namespace"]
+	tableName := mux.Vars(r)["table"]
+	http.Redirect(w, r, dash.P(r.Context(), "/object-store/s3tables/buckets/"+url.PathEscape(catalogName)+"/namespaces/"+url.PathEscape(namespace)+"/tables/"+url.PathEscape(tableName)), http.StatusMovedPermanently)
+}
+
+// ShowBucketDetails returns detailed information about a specific bucket
+func (h *AdminHandlers) ShowBucketDetails(w http.ResponseWriter, r *http.Request) {
+	bucketName := mux.Vars(r)["bucket"]
+	details, err := h.adminServer.GetBucketDetails(bucketName)
+	if err != nil {
+		writeJSONError(w, http.StatusInternalServerError, "Failed to get bucket details: "+err.Error())
+		return
+	}
+	writeJSON(w, http.StatusOK, details)
+}
+
+// getS3BucketsData retrieves Object Store buckets data from the server with pagination
+func (h *AdminHandlers) getS3BucketsData(r *http.Request, page, pageSize int, sortBy, sortOrder string) dash.S3BucketsData {
+	username := dash.UsernameFromContext(r.Context())
+	if username == "" {
+		username = "admin"
+	}
+
+	// Get Object Store buckets data
+	data, err := h.adminServer.GetS3BucketsData(page, pageSize, sortBy, sortOrder)
+	if err != nil {
+		// Return empty data on error
+		return dash.S3BucketsData{
+			Username:     username,
+			Buckets:      []dash.S3Bucket{},
+			TotalBuckets: 0,
+			TotalSize:    0,
+			LastUpdated:  time.Now(),
+			CurrentPage:  1,
+			TotalPages:   1,
+			PageSize:     pageSize,
+			SortBy:       sortBy,
+			SortOrder:    sortOrder,
+		}
+	}
+
+	data.Username = username
+	return data
+}
+
+// getAdminData retrieves admin data from the server (now uses consolidated method)
+func (h *AdminHandlers) getAdminData(r *http.Request) dash.AdminData {
+	username := dash.UsernameFromContext(r.Context())
+
+	// Use the consolidated GetAdminData method from AdminServer
+	adminData, err := h.adminServer.GetAdminData(username)
+	if err != nil {
+		// Return default data when services are not available
+		if username == "" {
+			username = "admin"
+		}
+
+		masterNodes := []dash.MasterNode{
+			{
+				Address:  "localhost:9333",
+				IsLeader: true,
+			},
+		}
+
+		return dash.AdminData{
+			Username:      username,
+			TotalVolumes:  0,
+			TotalChunks:   0,
+			TotalSize:     0,
+			MasterNodes:   masterNodes,
+			VolumeServers: []dash.VolumeServer{},
+			FilerNodes:    []dash.FilerNode{},
+			DataCenters:   []dash.DataCenter{},
+			LastUpdated:   time.Now(),
+		}
+	}
+
+	return adminData
+}
+
+// Helper functions

weed/admin/handlers/admin_handlers_routes_test.go

@@ -0,0 +1,198 @@
+package handlers
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/gorilla/mux"
+	"github.com/gorilla/sessions"
+	"github.com/seaweedfs/seaweedfs/weed/admin/dash"
+)
+
+func TestSetupRoutes_RegistersPluginSchedulerStatesAPI_NoAuth(t *testing.T) {
+	router := mux.NewRouter()
+
+	newRouteTestAdminHandlers().SetupRoutes(router, false, "", "", "", "", true)
+
+	if !hasRoute(router, http.MethodGet, "/api/plugin/scheduler-states") {
+		t.Fatalf("expected GET /api/plugin/scheduler-states to be registered in no-auth mode")
+	}
+	if !hasRoute(router, http.MethodGet, "/api/plugin/jobs/example/detail") {
+		t.Fatalf("expected GET /api/plugin/jobs/:jobId/detail to be registered in no-auth mode")
+	}
+	if !hasRoute(router, http.MethodPost, "/api/plugin/jobs/example/expire") {
+		t.Fatalf("expected POST /api/plugin/jobs/:jobId/expire to be registered in no-auth mode")
+	}
+}
+
+func TestSetupRoutes_RegistersPluginSchedulerStatesAPI_WithAuth(t *testing.T) {
+	router := mux.NewRouter()
+
+	newRouteTestAdminHandlers().SetupRoutes(router, true, "admin", "password", "", "", true)
+
+	if !hasRoute(router, http.MethodGet, "/api/plugin/scheduler-states") {
+		t.Fatalf("expected GET /api/plugin/scheduler-states to be registered in auth mode")
+	}
+	if !hasRoute(router, http.MethodGet, "/api/plugin/jobs/example/detail") {
+		t.Fatalf("expected GET /api/plugin/jobs/:jobId/detail to be registered in auth mode")
+	}
+	if !hasRoute(router, http.MethodPost, "/api/plugin/jobs/example/expire") {
+		t.Fatalf("expected POST /api/plugin/jobs/:jobId/expire to be registered in auth mode")
+	}
+}
+
+func TestSetupRoutes_RegistersBucketLifecycleAPI_NoAuth(t *testing.T) {
+	router := mux.NewRouter()
+
+	newRouteTestAdminHandlers().SetupRoutes(router, false, "", "", "", "", true)
+
+	assertHasRoute(t, router, http.MethodGet, "/api/s3/buckets/example/lifecycle")
+	assertHasRoute(t, router, http.MethodPut, "/api/s3/buckets/example/lifecycle")
+	assertHasRoute(t, router, http.MethodDelete, "/api/s3/buckets/example/lifecycle")
+}
+
+func TestSetupRoutes_RegistersBucketLifecycleAPI_WithAuth(t *testing.T) {
+	router := mux.NewRouter()
+
+	newRouteTestAdminHandlers().SetupRoutes(router, true, "admin", "password", "", "", true)
+
+	assertHasRoute(t, router, http.MethodGet, "/api/s3/buckets/example/lifecycle")
+	assertHasRoute(t, router, http.MethodPut, "/api/s3/buckets/example/lifecycle")
+	assertHasRoute(t, router, http.MethodDelete, "/api/s3/buckets/example/lifecycle")
+}
+
+func TestSetupRoutes_RegistersBucketPolicyAPI_NoAuth(t *testing.T) {
+	router := mux.NewRouter()
+
+	newRouteTestAdminHandlers().SetupRoutes(router, false, "", "", "", "", true)
+
+	assertHasRoute(t, router, http.MethodGet, "/api/s3/buckets/example/policy")
+	assertHasRoute(t, router, http.MethodPut, "/api/s3/buckets/example/policy")
+	assertHasRoute(t, router, http.MethodDelete, "/api/s3/buckets/example/policy")
+}
+
+func TestSetupRoutes_RegistersBucketPolicyAPI_WithAuth(t *testing.T) {
+	router := mux.NewRouter()
+
+	newRouteTestAdminHandlers().SetupRoutes(router, true, "admin", "password", "", "", true)
+
+	assertHasRoute(t, router, http.MethodGet, "/api/s3/buckets/example/policy")
+	assertHasRoute(t, router, http.MethodPut, "/api/s3/buckets/example/policy")
+	assertHasRoute(t, router, http.MethodDelete, "/api/s3/buckets/example/policy")
+}
+
+func TestSetupRoutes_RegistersPolicyAPI_NoAuth(t *testing.T) {
+	router := mux.NewRouter()
+
+	newRouteTestAdminHandlers().SetupRoutes(router, false, "", "", "", "", true)
+
+	assertHasRoute(t, router, http.MethodGet, "/api/object-store/policies")
+	assertHasRoute(t, router, http.MethodPost, "/api/object-store/policies")
+	assertHasRoute(t, router, http.MethodGet, "/api/object-store/policies/example")
+	assertHasRoute(t, router, http.MethodPut, "/api/object-store/policies/example")
+	assertHasRoute(t, router, http.MethodDelete, "/api/object-store/policies/example")
+	assertHasRoute(t, router, http.MethodPost, "/api/object-store/policies/validate")
+}
+
+func TestSetupRoutes_RegistersPolicyAPI_WithAuth(t *testing.T) {
+	router := mux.NewRouter()
+
+	newRouteTestAdminHandlers().SetupRoutes(router, true, "admin", "password", "", "", true)
+
+	assertHasRoute(t, router, http.MethodGet, "/api/object-store/policies")
+	assertHasRoute(t, router, http.MethodPost, "/api/object-store/policies")
+	assertHasRoute(t, router, http.MethodGet, "/api/object-store/policies/example")
+	assertHasRoute(t, router, http.MethodPut, "/api/object-store/policies/example")
+	assertHasRoute(t, router, http.MethodDelete, "/api/object-store/policies/example")
+	assertHasRoute(t, router, http.MethodPost, "/api/object-store/policies/validate")
+}
+
+func TestSetupRoutes_RegistersPrincipalsAPI_NoAuth(t *testing.T) {
+	router := mux.NewRouter()
+
+	newRouteTestAdminHandlers().SetupRoutes(router, false, "", "", "", "", true)
+
+	assertHasRoute(t, router, http.MethodGet, "/api/principals")
+}
+
+func TestSetupRoutes_RegistersFilesListFoldersAPI_NoAuth(t *testing.T) {
+	router := mux.NewRouter()
+
+	newRouteTestAdminHandlers().SetupRoutes(router, false, "", "", "", "", true)
+
+	assertHasRoute(t, router, http.MethodGet, "/api/files/list-folders")
+}
+
+func TestSetupRoutes_RegistersPluginPages_NoAuth(t *testing.T) {
+	router := mux.NewRouter()
+
+	newRouteTestAdminHandlers().SetupRoutes(router, false, "", "", "", "", true)
+
+	assertHasRoute(t, router, http.MethodGet, "/plugin")
+	assertHasRoute(t, router, http.MethodGet, "/plugin/configuration")
+	assertHasRoute(t, router, http.MethodGet, "/plugin/queue")
+	assertHasRoute(t, router, http.MethodGet, "/plugin/detection")
+	assertHasRoute(t, router, http.MethodGet, "/plugin/execution")
+	assertHasRoute(t, router, http.MethodGet, "/plugin/monitoring")
+	assertHasRoute(t, router, http.MethodGet, "/plugin/lanes/default")
+	assertHasRoute(t, router, http.MethodGet, "/plugin/lanes/default/configuration")
+	assertHasRoute(t, router, http.MethodGet, "/plugin/lanes/default/queue")
+	assertHasRoute(t, router, http.MethodGet, "/plugin/lanes/default/detection")
+	assertHasRoute(t, router, http.MethodGet, "/plugin/lanes/default/execution")
+	assertHasRoute(t, router, http.MethodGet, "/plugin/lanes/default/monitoring")
+	assertHasRoute(t, router, http.MethodGet, "/plugin/lanes/default/workers")
+	assertHasRoute(t, router, http.MethodGet, "/plugin/lanes/lifecycle")
+	assertHasRoute(t, router, http.MethodGet, "/plugin/lanes/lifecycle/configuration")
+	assertHasRoute(t, router, http.MethodGet, "/plugin/lanes/lifecycle/workers")
+}
+
+func TestSetupRoutes_RegistersPluginPages_WithAuth(t *testing.T) {
+	router := mux.NewRouter()
+
+	newRouteTestAdminHandlers().SetupRoutes(router, true, "admin", "password", "", "", true)
+
+	assertHasRoute(t, router, http.MethodGet, "/plugin")
+	assertHasRoute(t, router, http.MethodGet, "/plugin/configuration")
+	assertHasRoute(t, router, http.MethodGet, "/plugin/queue")
+	assertHasRoute(t, router, http.MethodGet, "/plugin/detection")
+	assertHasRoute(t, router, http.MethodGet, "/plugin/execution")
+	assertHasRoute(t, router, http.MethodGet, "/plugin/monitoring")
+	assertHasRoute(t, router, http.MethodGet, "/plugin/lanes/iceberg")
+	assertHasRoute(t, router, http.MethodGet, "/plugin/lanes/iceberg/configuration")
+	assertHasRoute(t, router, http.MethodGet, "/plugin/lanes/iceberg/queue")
+	assertHasRoute(t, router, http.MethodGet, "/plugin/lanes/iceberg/detection")
+	assertHasRoute(t, router, http.MethodGet, "/plugin/lanes/iceberg/execution")
+	assertHasRoute(t, router, http.MethodGet, "/plugin/lanes/iceberg/monitoring")
+	assertHasRoute(t, router, http.MethodGet, "/plugin/lanes/iceberg/workers")
+}
+
+func newRouteTestAdminHandlers() *AdminHandlers {
+	adminServer := &dash.AdminServer{}
+	store := sessions.NewCookieStore([]byte("test-session-key"))
+	return &AdminHandlers{
+		adminServer:            adminServer,
+		sessionStore:           store,
+		authHandlers:           &AuthHandlers{adminServer: adminServer, sessionStore: store},
+		clusterHandlers:        &ClusterHandlers{adminServer: adminServer},
+		fileBrowserHandlers:    &FileBrowserHandlers{adminServer: adminServer},
+		userHandlers:           &UserHandlers{adminServer: adminServer},
+		policyHandlers:         &PolicyHandlers{adminServer: adminServer},
+		pluginHandlers:         &PluginHandlers{adminServer: adminServer},
+		mqHandlers:             &MessageQueueHandlers{adminServer: adminServer},
+		serviceAccountHandlers: &ServiceAccountHandlers{adminServer: adminServer},
+	}
+}
+
+func hasRoute(router *mux.Router, method string, path string) bool {
+	req := httptest.NewRequest(method, path, nil)
+	var match mux.RouteMatch
+	return router.Match(req, &match)
+}
+
+func assertHasRoute(t *testing.T, router *mux.Router, method string, path string) {
+	t.Helper()
+	if !hasRoute(router, method, path) {
+		t.Fatalf("expected %s %s to be registered", method, path)
+	}
+}

weed/admin/handlers/auth_handlers.go

@@ -0,0 +1,67 @@
+package handlers
+
+import (
+	"net/http"
+
+	"github.com/gorilla/sessions"
+	"github.com/seaweedfs/seaweedfs/weed/admin/dash"
+	"github.com/seaweedfs/seaweedfs/weed/admin/view/layout"
+	"github.com/seaweedfs/seaweedfs/weed/glog"
+)
+
+// AuthHandlers contains authentication-related HTTP handlers
+type AuthHandlers struct {
+	adminServer  *dash.AdminServer
+	sessionStore sessions.Store
+}
+
+// NewAuthHandlers creates a new instance of AuthHandlers
+func NewAuthHandlers(adminServer *dash.AdminServer, store sessions.Store) *AuthHandlers {
+	return &AuthHandlers{
+		adminServer:  adminServer,
+		sessionStore: store,
+	}
+}
+
+// ShowLogin displays the login page
+func (a *AuthHandlers) ShowLogin(w http.ResponseWriter, r *http.Request) {
+	session, err := a.sessionStore.Get(r, dash.SessionName())
+	var csrfToken string
+	if err == nil {
+		if authenticated, _ := session.Values["authenticated"].(bool); authenticated {
+			http.Redirect(w, r, dash.P(r.Context(), "/admin"), http.StatusSeeOther)
+			return
+		}
+	} else {
+		glog.V(1).Infof("Failed to load session for login page: %v", err)
+	}
+
+	if session != nil {
+		token, tokenErr := dash.EnsureSessionCSRFToken(session, r, w)
+		if tokenErr != nil {
+			glog.V(1).Infof("Failed to ensure CSRF token for login page: %v", tokenErr)
+		} else {
+			csrfToken = token
+		}
+	}
+
+	errorMessage := r.URL.Query().Get("error")
+
+	// Render login template
+	w.Header().Set("Content-Type", "text/html")
+	loginComponent := layout.LoginForm("SeaweedFS Admin", errorMessage, csrfToken)
+	if err := loginComponent.Render(r.Context(), w); err != nil {
+		writeJSONError(w, http.StatusInternalServerError, "Failed to render login template: "+err.Error())
+		return
+	}
+}
+
+// HandleLogin handles login form submission
+func (a *AuthHandlers) HandleLogin(adminUser, adminPassword, readOnlyUser, readOnlyPassword string) http.HandlerFunc {
+	return a.adminServer.HandleLogin(a.sessionStore, adminUser, adminPassword, readOnlyUser, readOnlyPassword)
+}
+
+// HandleLogout handles user logout
+func (a *AuthHandlers) HandleLogout(w http.ResponseWriter, r *http.Request) {
+	a.adminServer.HandleLogout(a.sessionStore, w, r)
+}

weed/admin/handlers/cluster_handlers.go

@@ -0,0 +1,507 @@
+package handlers
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"math"
+	"mime"
+	"net/http"
+	"strconv"
+	"time"
+
+	"github.com/gorilla/mux"
+	"github.com/seaweedfs/seaweedfs/weed/admin/dash"
+	"github.com/seaweedfs/seaweedfs/weed/admin/view/app"
+	"github.com/seaweedfs/seaweedfs/weed/admin/view/layout"
+	"github.com/seaweedfs/seaweedfs/weed/glog"
+)
+
+// ClusterHandlers contains all the HTTP handlers for cluster management
+type ClusterHandlers struct {
+	adminServer *dash.AdminServer
+}
+
+// NewClusterHandlers creates a new instance of ClusterHandlers
+func NewClusterHandlers(adminServer *dash.AdminServer) *ClusterHandlers {
+	return &ClusterHandlers{
+		adminServer: adminServer,
+	}
+}
+
+// ShowClusterVolumeServers renders the cluster volume servers page
+func (h *ClusterHandlers) ShowClusterVolumeServers(w http.ResponseWriter, r *http.Request) {
+	// Get cluster volume servers data
+	volumeServersData, err := h.adminServer.GetClusterVolumeServers()
+	if err != nil {
+		writeJSONError(w, http.StatusInternalServerError, "Failed to get cluster volume servers: "+err.Error())
+		return
+	}
+
+	username := usernameOrDefault(r)
+	volumeServersData.Username = username
+
+	// Render HTML template
+	w.Header().Set("Content-Type", "text/html")
+	volumeServersComponent := app.ClusterVolumeServers(*volumeServersData)
+	viewCtx := layout.NewViewContext(r, username, dash.CSRFTokenFromContext(r.Context()))
+	layoutComponent := layout.Layout(viewCtx, volumeServersComponent)
+	if err := layoutComponent.Render(r.Context(), w); err != nil {
+		writeJSONError(w, http.StatusInternalServerError, "Failed to render template: "+err.Error())
+		return
+	}
+}
+
+// ShowMountClients renders the connected FUSE/VFS mount clients page
+func (h *ClusterHandlers) ShowMountClients(w http.ResponseWriter, r *http.Request) {
+	data, err := h.adminServer.GetMountClients()
+	if err != nil {
+		writeJSONError(w, http.StatusInternalServerError, "Failed to get mount clients: "+err.Error())
+		return
+	}
+
+	username := usernameOrDefault(r)
+	data.Username = username
+
+	// Render HTML template
+	w.Header().Set("Content-Type", "text/html")
+	mountClientsComponent := app.MountClients(*data)
+	viewCtx := layout.NewViewContext(r, username, dash.CSRFTokenFromContext(r.Context()))
+	layoutComponent := layout.Layout(viewCtx, mountClientsComponent)
+	if err := layoutComponent.Render(r.Context(), w); err != nil {
+		writeJSONError(w, http.StatusInternalServerError, "Failed to render template: "+err.Error())
+		return
+	}
+}
+
+// ShowClusterVolumes renders the cluster volumes page
+func (h *ClusterHandlers) ShowClusterVolumes(w http.ResponseWriter, r *http.Request) {
+	// Get pagination and sorting parameters from query string
+	page := 1
+	if p := r.URL.Query().Get("page"); p != "" {
+		if parsed, err := strconv.Atoi(p); err == nil && parsed > 0 {
+			page = parsed
+		}
+	}
+
+	pageSize := 100
+	if ps := r.URL.Query().Get("pageSize"); ps != "" {
+		if parsed, err := strconv.Atoi(ps); err == nil && parsed > 0 && parsed <= 1000 {
+			pageSize = parsed
+		}
+	}
+
+	sortBy := defaultQuery(r.URL.Query().Get("sortBy"), "id")
+	sortOrder := defaultQuery(r.URL.Query().Get("sortOrder"), "asc")
+	collection := r.URL.Query().Get("collection") // Optional collection filter
+
+	// Get cluster volumes data
+	volumesData, err := h.adminServer.GetClusterVolumes(page, pageSize, sortBy, sortOrder, collection)
+	if err != nil {
+		writeJSONError(w, http.StatusInternalServerError, "Failed to get cluster volumes: "+err.Error())
+		return
+	}
+
+	username := usernameOrDefault(r)
+	volumesData.Username = username
+
+	// Render HTML template
+	w.Header().Set("Content-Type", "text/html")
+	volumesComponent := app.ClusterVolumes(*volumesData)
+	viewCtx := layout.NewViewContext(r, username, dash.CSRFTokenFromContext(r.Context()))
+	layoutComponent := layout.Layout(viewCtx, volumesComponent)
+	if err := layoutComponent.Render(r.Context(), w); err != nil {
+		writeJSONError(w, http.StatusInternalServerError, "Failed to render template: "+err.Error())
+		return
+	}
+}
+
+// ExportClusterVolumes streams the full-cluster volume list as a downloadable
+// JSON report: every volume and EC shard across the topology, with more fields
+// than the paginated table (a superset of the volume.list shell command).
+func (h *ClusterHandlers) ExportClusterVolumes(w http.ResponseWriter, r *http.Request) {
+	collection := r.URL.Query().Get("collection") // Optional collection filter
+
+	export, err := h.adminServer.ExportClusterVolumeList(r.Context(), collection, time.Now().UTC())
+	if err != nil {
+		writeJSONError(w, http.StatusInternalServerError, "Failed to export volume list: "+err.Error())
+		return
+	}
+
+	filename := fmt.Sprintf("seaweedfs-volumes-%s.json", export.GeneratedAt.Format("20060102-150405"))
+	w.Header().Set("Content-Type", "application/json")
+	w.Header().Set("Content-Disposition", mime.FormatMediaType("attachment", map[string]string{"filename": filename}))
+
+	enc := json.NewEncoder(w)
+	enc.SetIndent("", "  ")
+	if err := enc.Encode(export); err != nil {
+		// The response is already streaming, so we can only log a late failure.
+		glog.Errorf("export volume list: encode failed: %v", err)
+	}
+}
+
+// ShowVolumeDetails renders the volume details page
+func (h *ClusterHandlers) ShowVolumeDetails(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	volumeIDStr := vars["id"]
+	server := vars["server"]
+
+	if volumeIDStr == "" {
+		writeJSONError(w, http.StatusBadRequest, "Volume ID is required")
+		return
+	}
+
+	if server == "" {
+		writeJSONError(w, http.StatusBadRequest, "Server is required")
+		return
+	}
+
+	volumeID, err := strconv.ParseUint(volumeIDStr, 10, 32)
+	if err != nil {
+		writeJSONError(w, http.StatusBadRequest, "Invalid volume ID")
+		return
+	}
+
+	// Get volume details
+	volumeDetails, err := h.adminServer.GetVolumeDetails(uint32(volumeID), server)
+	if err != nil {
+		writeJSONError(w, http.StatusInternalServerError, "Failed to get volume details: "+err.Error())
+		return
+	}
+
+	username := usernameOrDefault(r)
+	// Render HTML template
+	w.Header().Set("Content-Type", "text/html")
+	volumeDetailsComponent := app.VolumeDetails(*volumeDetails)
+	viewCtx := layout.NewViewContext(r, username, dash.CSRFTokenFromContext(r.Context()))
+	layoutComponent := layout.Layout(viewCtx, volumeDetailsComponent)
+	if err := layoutComponent.Render(r.Context(), w); err != nil {
+		writeJSONError(w, http.StatusInternalServerError, "Failed to render template: "+err.Error())
+		return
+	}
+}
+
+// ShowClusterCollections renders the cluster collections page
+func (h *ClusterHandlers) ShowClusterCollections(w http.ResponseWriter, r *http.Request) {
+	// Get cluster collections data
+	collectionsData, err := h.adminServer.GetClusterCollections()
+	if err != nil {
+		writeJSONError(w, http.StatusInternalServerError, "Failed to get cluster collections: "+err.Error())
+		return
+	}
+
+	username := usernameOrDefault(r)
+	collectionsData.Username = username
+
+	// Render HTML template
+	w.Header().Set("Content-Type", "text/html")
+	collectionsComponent := app.ClusterCollections(*collectionsData)
+	viewCtx := layout.NewViewContext(r, username, dash.CSRFTokenFromContext(r.Context()))
+	layoutComponent := layout.Layout(viewCtx, collectionsComponent)
+	if err := layoutComponent.Render(r.Context(), w); err != nil {
+		writeJSONError(w, http.StatusInternalServerError, "Failed to render template: "+err.Error())
+		return
+	}
+}
+
+// ShowCollectionDetails renders the collection detail page
+func (h *ClusterHandlers) ShowCollectionDetails(w http.ResponseWriter, r *http.Request) {
+	collectionName := mux.Vars(r)["name"]
+	if collectionName == "" {
+		writeJSONError(w, http.StatusBadRequest, "Collection name is required")
+		return
+	}
+
+	// Parse query parameters
+	query := r.URL.Query()
+	page, _ := strconv.Atoi(defaultQuery(query.Get("page"), "1"))
+	pageSize, _ := strconv.Atoi(defaultQuery(query.Get("page_size"), "25"))
+	sortBy := defaultQuery(query.Get("sort_by"), "volume_id")
+	sortOrder := defaultQuery(query.Get("sort_order"), "asc")
+
+	// Get collection details data (volumes and EC volumes)
+	collectionDetailsData, err := h.adminServer.GetCollectionDetails(collectionName, page, pageSize, sortBy, sortOrder)
+	if err != nil {
+		writeJSONError(w, http.StatusInternalServerError, "Failed to get collection details: "+err.Error())
+		return
+	}
+
+	username := usernameOrDefault(r)
+	collectionDetailsData.Username = username
+
+	// Render HTML template
+	w.Header().Set("Content-Type", "text/html")
+	collectionDetailsComponent := app.CollectionDetails(*collectionDetailsData)
+	viewCtx := layout.NewViewContext(r, username, dash.CSRFTokenFromContext(r.Context()))
+	layoutComponent := layout.Layout(viewCtx, collectionDetailsComponent)
+	if err := layoutComponent.Render(r.Context(), w); err != nil {
+		writeJSONError(w, http.StatusInternalServerError, "Failed to render template: "+err.Error())
+		return
+	}
+}
+
+// ShowClusterEcShards handles the cluster EC shards page (individual shards view)
+func (h *ClusterHandlers) ShowClusterEcShards(w http.ResponseWriter, r *http.Request) {
+	// Parse query parameters
+	query := r.URL.Query()
+	page, _ := strconv.Atoi(defaultQuery(query.Get("page"), "1"))
+	pageSize, _ := strconv.Atoi(defaultQuery(query.Get("page_size"), "100"))
+	sortBy := defaultQuery(query.Get("sort_by"), "volume_id")
+	sortOrder := defaultQuery(query.Get("sort_order"), "asc")
+	collection := defaultQuery(query.Get("collection"), "")
+
+	// Get data from admin server
+	data, err := h.adminServer.GetClusterEcVolumes(page, pageSize, sortBy, sortOrder, collection)
+	if err != nil {
+		writeJSONError(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+
+	username := usernameOrDefault(r)
+	data.Username = username
+
+	// Render template
+	w.Header().Set("Content-Type", "text/html")
+	ecVolumesComponent := app.ClusterEcVolumes(*data)
+	viewCtx := layout.NewViewContext(r, username, dash.CSRFTokenFromContext(r.Context()))
+	layoutComponent := layout.Layout(viewCtx, ecVolumesComponent)
+	if err := layoutComponent.Render(r.Context(), w); err != nil {
+		writeJSONError(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+}
+
+// ShowEcVolumeDetails renders the EC volume details page
+func (h *ClusterHandlers) ShowEcVolumeDetails(w http.ResponseWriter, r *http.Request) {
+	volumeIDStr := mux.Vars(r)["id"]
+
+	if volumeIDStr == "" {
+		writeJSONError(w, http.StatusBadRequest, "Volume ID is required")
+		return
+	}
+
+	volumeID, err := strconv.Atoi(volumeIDStr)
+	if err != nil {
+		writeJSONError(w, http.StatusBadRequest, "Invalid volume ID")
+		return
+	}
+
+	// Check that volumeID is within uint32 range
+	if volumeID < 0 || uint64(volumeID) > math.MaxUint32 {
+		writeJSONError(w, http.StatusBadRequest, "Volume ID out of range")
+		return
+	}
+
+	// Parse sorting parameters
+	query := r.URL.Query()
+	sortBy := defaultQuery(query.Get("sort_by"), "shard_id")
+	sortOrder := defaultQuery(query.Get("sort_order"), "asc")
+
+	// Get EC volume details
+	ecVolumeDetails, err := h.adminServer.GetEcVolumeDetails(uint32(volumeID), sortBy, sortOrder)
+	if err != nil {
+		writeJSONError(w, http.StatusInternalServerError, "Failed to get EC volume details: "+err.Error())
+		return
+	}
+
+	username := usernameOrDefault(r)
+	ecVolumeDetails.Username = username
+
+	// Render HTML template
+	w.Header().Set("Content-Type", "text/html")
+	ecVolumeDetailsComponent := app.EcVolumeDetails(*ecVolumeDetails)
+	viewCtx := layout.NewViewContext(r, username, dash.CSRFTokenFromContext(r.Context()))
+	layoutComponent := layout.Layout(viewCtx, ecVolumeDetailsComponent)
+	if err := layoutComponent.Render(r.Context(), w); err != nil {
+		writeJSONError(w, http.StatusInternalServerError, "Failed to render template: "+err.Error())
+		return
+	}
+}
+
+// ShowClusterMasters renders the cluster masters page
+func (h *ClusterHandlers) ShowClusterMasters(w http.ResponseWriter, r *http.Request) {
+	// Get cluster masters data
+	mastersData, err := h.adminServer.GetClusterMasters()
+	if err != nil {
+		writeJSONError(w, http.StatusInternalServerError, "Failed to get cluster masters: "+err.Error())
+		return
+	}
+
+	username := usernameOrDefault(r)
+	mastersData.Username = username
+
+	// Render HTML template
+	w.Header().Set("Content-Type", "text/html")
+	mastersComponent := app.ClusterMasters(*mastersData)
+	viewCtx := layout.NewViewContext(r, username, dash.CSRFTokenFromContext(r.Context()))
+	layoutComponent := layout.Layout(viewCtx, mastersComponent)
+	if err := layoutComponent.Render(r.Context(), w); err != nil {
+		writeJSONError(w, http.StatusInternalServerError, "Failed to render template: "+err.Error())
+		return
+	}
+}
+
+// ShowClusterFilers renders the cluster filers page
+func (h *ClusterHandlers) ShowClusterFilers(w http.ResponseWriter, r *http.Request) {
+	// Get cluster filers data
+	filersData, err := h.adminServer.GetClusterFilers()
+	if err != nil {
+		writeJSONError(w, http.StatusInternalServerError, "Failed to get cluster filers: "+err.Error())
+		return
+	}
+
+	username := usernameOrDefault(r)
+	filersData.Username = username
+
+	// Render HTML template
+	w.Header().Set("Content-Type", "text/html")
+	filersComponent := app.ClusterFilers(*filersData)
+	viewCtx := layout.NewViewContext(r, username, dash.CSRFTokenFromContext(r.Context()))
+	layoutComponent := layout.Layout(viewCtx, filersComponent)
+	if err := layoutComponent.Render(r.Context(), w); err != nil {
+		writeJSONError(w, http.StatusInternalServerError, "Failed to render template: "+err.Error())
+		return
+	}
+}
+
+// ShowClusterS3Servers renders the cluster S3 servers page
+func (h *ClusterHandlers) ShowClusterS3Servers(w http.ResponseWriter, r *http.Request) {
+	// Get cluster S3 servers data
+	s3ServersData, err := h.adminServer.GetClusterS3Servers()
+	if err != nil {
+		writeJSONError(w, http.StatusInternalServerError, "Failed to get cluster S3 servers: "+err.Error())
+		return
+	}
+
+	username := usernameOrDefault(r)
+	s3ServersData.Username = username
+
+	// Render HTML template
+	w.Header().Set("Content-Type", "text/html")
+	s3ServersComponent := app.ClusterS3Servers(*s3ServersData)
+	viewCtx := layout.NewViewContext(r, username, dash.CSRFTokenFromContext(r.Context()))
+	layoutComponent := layout.Layout(viewCtx, s3ServersComponent)
+	if err := layoutComponent.Render(r.Context(), w); err != nil {
+		writeJSONError(w, http.StatusInternalServerError, "Failed to render template: "+err.Error())
+		return
+	}
+}
+
+// GetClusterTopology returns the cluster topology as JSON
+func (h *ClusterHandlers) GetClusterTopology(w http.ResponseWriter, r *http.Request) {
+	topology, err := h.adminServer.GetClusterTopology()
+	if err != nil {
+		writeJSONError(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+	writeJSON(w, http.StatusOK, topology)
+}
+
+// GetMasters returns master node information
+func (h *ClusterHandlers) GetMasters(w http.ResponseWriter, r *http.Request) {
+	mastersData, err := h.adminServer.GetClusterMasters()
+	if err != nil {
+		writeJSONError(w, http.StatusInternalServerError, "Failed to get cluster masters: "+err.Error())
+		return
+	}
+	writeJSON(w, http.StatusOK, mastersData)
+}
+
+// GetVolumeServers returns volume server information
+func (h *ClusterHandlers) GetVolumeServers(w http.ResponseWriter, r *http.Request) {
+	topology, err := h.adminServer.GetClusterTopology()
+	if err != nil {
+		writeJSONError(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]interface{}{"volume_servers": topology.VolumeServers})
+}
+
+// SetVolumeReadOnly handles access mode changes for a single volume replica.
+func (h *ClusterHandlers) SetVolumeReadOnly(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	volumeID, err := strconv.ParseUint(vars["id"], 10, 32)
+	if err != nil {
+		writeJSONError(w, http.StatusBadRequest, "Invalid volume ID")
+		return
+	}
+	server := vars["server"]
+	if server == "" {
+		writeJSONError(w, http.StatusBadRequest, "Server is required")
+		return
+	}
+	var request struct {
+		ReadOnly *bool `json:"read_only"`
+	}
+	decoder := json.NewDecoder(r.Body)
+	if err := decoder.Decode(&request); err != nil || request.ReadOnly == nil {
+		writeJSONError(w, http.StatusBadRequest, "read_only must be a boolean")
+		return
+	}
+	if err := decoder.Decode(&struct{}{}); err != io.EOF {
+		writeJSONError(w, http.StatusBadRequest, "read_only must be a boolean")
+		return
+	}
+
+	ctx, cancel := context.WithTimeout(r.Context(), 30*time.Second)
+	defer cancel()
+	if err := h.adminServer.SetVolumeReadOnly(ctx, uint32(volumeID), server, *request.ReadOnly); err != nil {
+		writeJSONError(w, http.StatusInternalServerError, "Failed to change volume access mode: "+err.Error())
+		return
+	}
+	mode := "read/write"
+	if *request.ReadOnly {
+		mode = "read-only"
+	}
+	writeJSON(w, http.StatusOK, map[string]interface{}{
+		"message":   fmt.Sprintf("Volume %d on %s marked %s", volumeID, server, mode),
+		"volume_id": volumeID,
+		"server":    server,
+		"read_only": *request.ReadOnly,
+	})
+}
+
+// VacuumVolume handles volume vacuum requests via API
+func (h *ClusterHandlers) VacuumVolume(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	volumeIDStr := vars["id"]
+	server := vars["server"]
+
+	if volumeIDStr == "" {
+		writeJSONError(w, http.StatusBadRequest, "Volume ID is required")
+		return
+	}
+
+	volumeID, err := strconv.Atoi(volumeIDStr)
+	if err != nil {
+		writeJSONError(w, http.StatusBadRequest, "Invalid volume ID")
+		return
+	}
+
+	if server == "" {
+		writeJSONError(w, http.StatusBadRequest, "Server is required")
+		return
+	}
+
+	// Perform vacuum operation
+	err = h.adminServer.VacuumVolume(volumeID, server)
+	if err != nil {
+		writeJSONError(w, http.StatusInternalServerError, "Failed to vacuum volume: "+err.Error())
+		return
+	}
+
+	writeJSON(w, http.StatusOK, map[string]interface{}{
+		"message":   "Volume vacuum started successfully",
+		"volume_id": volumeID,
+		"server":    server,
+	})
+}
+
+func usernameOrDefault(r *http.Request) string {
+	username := dash.UsernameFromContext(r.Context())
+	if username == "" {
+		return "admin"
+	}
+	return username
+}

weed/admin/handlers/cluster_handlers_test.go

@@ -0,0 +1,62 @@
+package handlers
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/gorilla/mux"
+	"github.com/seaweedfs/seaweedfs/weed/admin/dash"
+	"github.com/stretchr/testify/require"
+)
+
+func TestSetVolumeReadOnlyInvalidRequests(t *testing.T) {
+	for _, tc := range []struct {
+		name, id, server, body string
+	}{
+		{"missing volume", "", "node-a", `{"read_only":true}`},
+		{"negative volume", "-1", "node-a", `{"read_only":true}`},
+		{"overflow volume", "4294967296", "node-a", `{"read_only":true}`},
+		{"invalid volume", "abc", "node-a", `{"read_only":true}`},
+		{"missing server", "7", "", `{"read_only":true}`},
+		{"missing mode", "7", "node-a", `{}`},
+		{"null mode", "7", "node-a", `{"read_only":null}`},
+		{"string mode", "7", "node-a", `{"read_only":"false"}`},
+		{"malformed JSON", "7", "node-a", `{"read_only":`},
+		{"trailing JSON", "7", "node-a", `{"read_only":true}{}`},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			req := httptest.NewRequest(http.MethodPost, "/", strings.NewReader(tc.body))
+			req = mux.SetURLVars(req, map[string]string{"id": tc.id, "server": tc.server})
+			w := httptest.NewRecorder()
+			// Invalid input must be rejected before accessing the cluster.
+			(&ClusterHandlers{}).SetVolumeReadOnly(w, req)
+			require.Equal(t, http.StatusBadRequest, w.Code, w.Body.String())
+		})
+	}
+}
+
+func TestSetVolumeReadOnlyRoutePermissions(t *testing.T) {
+	for _, tc := range []struct {
+		name, role string
+		enforce    bool
+		wantStatus int
+	}{
+		{"read-only user", dash.RoleReadOnly, true, http.StatusForbidden},
+		{"admin", "admin", true, http.StatusBadRequest},
+		{"no authentication", "", false, http.StatusBadRequest},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			router := mux.NewRouter()
+			newRouteTestAdminHandlers().registerAPIRoutes(router.PathPrefix("/api").Subrouter(), tc.enforce)
+			// Deliberately omit the mode: allowed callers reach validation, while
+			// read-only callers must be rejected by the route's write guard.
+			req := httptest.NewRequest(http.MethodPost, "/api/volumes/7/node-a/read-only", strings.NewReader(`{}`))
+			req = req.WithContext(dash.WithAuthContext(req.Context(), "", tc.role, ""))
+			w := httptest.NewRecorder()
+			router.ServeHTTP(w, req)
+			require.Equal(t, tc.wantStatus, w.Code, w.Body.String())
+		})
+	}
+}

weed/admin/handlers/file_browser_grpc.go

@@ -0,0 +1,269 @@
+package handlers
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"io"
+	"mime"
+	"net/http"
+	"path"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/admin/dash"
+	"github.com/seaweedfs/seaweedfs/weed/filer"
+	"github.com/seaweedfs/seaweedfs/weed/glog"
+	"github.com/seaweedfs/seaweedfs/weed/operation"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/security"
+)
+
+// Admin upload chunk size, matching s3api so files split into the same fid-sized pieces.
+const adminUploadChunkSize = 8 * 1024 * 1024
+
+// File browser handlers backed by the filer gRPC service. They bypass the
+// filer's HTTP listener so the UI keeps working when the filer is started
+// with -disableHttp=true; chunk bytes still flow through the volume server
+// HTTP endpoints (which run on their own ports).
+
+// fetchFileContentGrpc reads file content via the filer gRPC service, looking
+// the entry up and then streaming the chunks straight from the volume servers.
+// When maxBytes > 0 the stream is truncated to that many bytes — used by the
+// "is this text?" sniff so unknown-MIME files don't get fully downloaded.
+func (h *FileBrowserHandlers) fetchFileContentGrpc(ctx context.Context, filePath string, maxBytes int) (string, error) {
+	cleanFilePath, err := h.validateAndCleanFilePath(filePath)
+	if err != nil {
+		return "", err
+	}
+
+	entry, err := h.lookupEntry(ctx, cleanFilePath)
+	if err != nil {
+		return "", err
+	}
+	if entry.IsDirectory {
+		return "", fmt.Errorf("path is a directory")
+	}
+
+	size := int64(filer.FileSize(entry))
+	streamSize := size
+	if maxBytes > 0 && streamSize > int64(maxBytes) {
+		streamSize = int64(maxBytes)
+	}
+
+	var buf bytes.Buffer
+	if err := h.streamEntryContent(ctx, entry, streamSize, &buf); err != nil {
+		return "", err
+	}
+	return buf.String(), nil
+}
+
+// downloadFileGrpc streams a file via gRPC + volume server HTTP. The
+// response writer receives the canonical attachment headers and the raw
+// bytes; this replaces the HTTP-to-filer proxy that used to run in
+// DownloadFile.
+func (h *FileBrowserHandlers) downloadFileGrpc(ctx context.Context, filePath string, w http.ResponseWriter, inline bool) error {
+	cleanFilePath, err := h.validateAndCleanFilePath(filePath)
+	if err != nil {
+		return err
+	}
+
+	entry, err := h.lookupEntry(ctx, cleanFilePath)
+	if err != nil {
+		return err
+	}
+	if entry.IsDirectory {
+		return fmt.Errorf("path is a directory")
+	}
+
+	size := int64(filer.FileSize(entry))
+
+	fileName := path.Base(cleanFilePath)
+
+	// Resolve mime like the viewer does so Content-Type and the inline check agree.
+	contentType := dash.ResolveEntryMime(entry)
+
+	// Only inline images and PDFs; serve the rest as attachments so a hostile upload
+	// (HTML, SVG) can't run as same-origin script. nosniff locks the declared type.
+	disposition := "attachment"
+	if inline && (strings.HasPrefix(contentType, "image/") || contentType == "application/pdf") {
+		disposition = "inline"
+	}
+	w.Header().Set("Content-Disposition", mime.FormatMediaType(disposition, map[string]string{"filename": fileName}))
+	w.Header().Set("Content-Type", contentType)
+	w.Header().Set("X-Content-Type-Options", "nosniff")
+	w.Header().Set("Content-Length", strconv.FormatInt(size, 10))
+	w.WriteHeader(http.StatusOK)
+
+	return h.streamEntryContent(ctx, entry, size, w)
+}
+
+// uploadFileGrpc streams the upload to volumes in 8 MiB chunks via the shared
+// chunked-upload helper, then registers the entry over the filer gRPC service.
+// Content always lands in volumes, never inlined on the entry.
+func (h *FileBrowserHandlers) uploadFileGrpc(ctx context.Context, filePath string, fileName string, mimeType string, reader io.Reader) error {
+	cleanFilePath, err := h.validateAndCleanFilePath(filePath)
+	if err != nil {
+		return err
+	}
+	dir := path.Dir(cleanFilePath)
+	if dir == "." {
+		dir = "/"
+	}
+	entryName := path.Base(cleanFilePath)
+	if mimeType == "" {
+		mimeType = "application/octet-stream"
+	}
+
+	assignFunc := func(ctx context.Context, count int, expectedDataSize uint64) (*operation.VolumeAssignRequest, *operation.AssignResult, error) {
+		var assignResp *filer_pb.AssignVolumeResponse
+		err := h.adminServer.WithFilerClient(func(client filer_pb.SeaweedFilerClient) error {
+			resp, assignErr := client.AssignVolume(ctx, &filer_pb.AssignVolumeRequest{
+				Count:            int32(count),
+				Path:             cleanFilePath,
+				ExpectedDataSize: expectedDataSize,
+			})
+			if assignErr != nil {
+				return assignErr
+			}
+			if resp.Error != "" {
+				return fmt.Errorf("%s", resp.Error)
+			}
+			assignResp = resp
+			return nil
+		})
+		if err != nil {
+			return nil, nil, err
+		}
+		if assignResp.Location == nil || assignResp.FileId == "" {
+			return nil, nil, fmt.Errorf("assign volume returned empty location")
+		}
+		return nil, &operation.AssignResult{
+			Fid:       assignResp.FileId,
+			Url:       assignResp.Location.Url,
+			PublicUrl: assignResp.Location.PublicUrl,
+			Count:     uint64(count),
+			Auth:      security.EncodedJwt(assignResp.Auth),
+			Fsync:     assignResp.Fsync,
+		}, nil
+	}
+
+	chunkResult, err := operation.UploadReaderInChunks(ctx, reader, &operation.ChunkedUploadOption{
+		ChunkSize:  adminUploadChunkSize,
+		MimeType:   mimeType,
+		AssignFunc: assignFunc,
+	})
+	if err != nil {
+		// Partial chunks come back even on error so we can clean them up rather
+		// than leaving orphaned data on volume servers.
+		if chunkResult != nil && len(chunkResult.FileChunks) > 0 {
+			h.deleteOrphanedChunks(chunkResult.FileChunks)
+		}
+		return fmt.Errorf("upload: %w", err)
+	}
+
+	now := time.Now()
+	entry := &filer_pb.Entry{
+		Name: entryName,
+		Attributes: &filer_pb.FuseAttributes{
+			FileSize: uint64(chunkResult.TotalSize),
+			Mtime:    now.Unix(),
+			Crtime:   now.Unix(),
+			FileMode: 0644,
+			Mime:     mimeType,
+		},
+	}
+	entry.Chunks = chunkResult.FileChunks
+
+	err = h.adminServer.WithFilerClient(func(client filer_pb.SeaweedFilerClient) error {
+		_, createErr := client.CreateEntry(ctx, &filer_pb.CreateEntryRequest{
+			Directory: dir,
+			Entry:     entry,
+		})
+		return createErr
+	})
+	if err != nil {
+		if len(chunkResult.FileChunks) > 0 {
+			h.deleteOrphanedChunks(chunkResult.FileChunks)
+		}
+		return fmt.Errorf("create entry: %w", err)
+	}
+	return nil
+}
+
+// deleteOrphanedChunks best-effort removes the chunk fids when an upload
+// fails partway through. Errors are logged; we can't surface them past the
+// caller's primary failure.
+func (h *FileBrowserHandlers) deleteOrphanedChunks(chunks []*filer_pb.FileChunk) {
+	fileIds := make([]string, 0, len(chunks))
+	for _, c := range chunks {
+		if fid := c.GetFileIdString(); fid != "" {
+			fileIds = append(fileIds, fid)
+		}
+	}
+	if len(fileIds) == 0 {
+		return
+	}
+	master := h.adminServer.GetMasterClient()
+	results := operation.DeleteFileIds(master.GetMaster, false, h.adminServer.GetGrpcDialOption(), fileIds)
+	for _, r := range results {
+		if r.Error != "" {
+			glog.Warningf("admin file browser: orphan chunk %s cleanup: %s", r.FileId, r.Error)
+		}
+	}
+}
+
+func (h *FileBrowserHandlers) lookupEntry(ctx context.Context, cleanFilePath string) (*filer_pb.Entry, error) {
+	dir := path.Dir(cleanFilePath)
+	if dir == "." {
+		dir = "/"
+	}
+	name := path.Base(cleanFilePath)
+	var entry *filer_pb.Entry
+	err := h.adminServer.WithFilerClient(func(client filer_pb.SeaweedFilerClient) error {
+		resp, lookupErr := client.LookupDirectoryEntry(ctx, &filer_pb.LookupDirectoryEntryRequest{
+			Directory: dir,
+			Name:      name,
+		})
+		if lookupErr != nil {
+			return lookupErr
+		}
+		if resp.Entry == nil {
+			return fmt.Errorf("not found")
+		}
+		entry = resp.Entry
+		return nil
+	})
+	return entry, err
+}
+
+func (h *FileBrowserHandlers) streamEntryContent(ctx context.Context, entry *filer_pb.Entry, size int64, w io.Writer) error {
+	if size == 0 {
+		// Inline content (small files stored directly on the entry) skip the
+		// chunk pipeline entirely.
+		if len(entry.Content) > 0 {
+			_, err := w.Write(entry.Content)
+			return err
+		}
+		return nil
+	}
+	if len(entry.Content) > 0 && len(entry.GetChunks()) == 0 {
+		_, err := w.Write(entry.Content)
+		return err
+	}
+
+	streamFn, err := filer.PrepareStreamContentWithThrottler(
+		ctx,
+		h.adminServer.GetMasterClient(),
+		dash.VolumeServerReadJwt,
+		entry.GetChunks(),
+		0,
+		size,
+		0,
+	)
+	if err != nil {
+		return fmt.Errorf("prepare stream: %w", err)
+	}
+	return streamFn(w)
+}

weed/admin/handlers/file_browser_handlers.go

@@ -0,0 +1,832 @@
+package handlers
+
+import (
+	"bufio"
+	"compress/gzip"
+	"context"
+	"fmt"
+	"io"
+	"mime"
+	"mime/multipart"
+	"net/http"
+	"os"
+	"path"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/admin/dash"
+	"github.com/seaweedfs/seaweedfs/weed/admin/view/app"
+	"github.com/seaweedfs/seaweedfs/weed/admin/view/layout"
+	"github.com/seaweedfs/seaweedfs/weed/filer"
+	"github.com/seaweedfs/seaweedfs/weed/glog"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+	"github.com/seaweedfs/seaweedfs/weed/util/http/client"
+	"google.golang.org/protobuf/proto"
+)
+
+type FileBrowserHandlers struct {
+	adminServer *dash.AdminServer
+	httpClient  *client.HTTPClient
+}
+
+func NewFileBrowserHandlers(adminServer *dash.AdminServer) *FileBrowserHandlers {
+	// Create HTTP client with TLS support from https.client configuration
+	// The client is created without a timeout - each operation will set its own timeout
+	// If TLS is enabled but misconfigured, fail fast to alert the operator immediately
+	// rather than silently falling back to HTTP and causing confusing runtime errors
+	httpClient, err := client.NewHttpClient(client.Client)
+	if err != nil {
+		glog.Fatalf("Failed to create HTTPS client for file browser: %v", err)
+	}
+
+	return &FileBrowserHandlers{
+		adminServer: adminServer,
+		httpClient:  httpClient,
+	}
+}
+
+// ShowFileBrowser renders the file browser page
+func (h *FileBrowserHandlers) ShowFileBrowser(w http.ResponseWriter, r *http.Request) {
+	// Get path from query parameter, default to root
+	path := defaultQuery(r.URL.Query().Get("path"), "/")
+	// Normalize Windows-style paths for consistency
+	path = util.CleanWindowsPath(path)
+
+	// Get pagination parameters
+	lastFileName := r.URL.Query().Get("lastFileName")
+
+	pageSize, err := strconv.Atoi(defaultQuery(r.URL.Query().Get("limit"), "20"))
+	if err != nil || pageSize < 1 {
+		pageSize = 20
+	}
+	if pageSize > 200 {
+		pageSize = 200
+	}
+
+	// Get file browser data with cursor-based pagination
+	browserData, err := h.adminServer.GetFileBrowser(path, "", lastFileName, pageSize)
+	if err != nil {
+		writeJSONError(w, http.StatusInternalServerError, "Failed to get file browser data: "+err.Error())
+		return
+	}
+
+	// Set username
+	username := dash.UsernameFromContext(r.Context())
+	if username == "" {
+		username = "admin"
+	}
+	browserData.Username = username
+
+	// Render HTML template
+	w.Header().Set("Content-Type", "text/html")
+	browserComponent := app.FileBrowser(*browserData)
+	viewCtx := layout.NewViewContext(r, username, dash.CSRFTokenFromContext(r.Context()))
+	layoutComponent := layout.Layout(viewCtx, browserComponent)
+	err = layoutComponent.Render(r.Context(), w)
+	if err != nil {
+		writeJSONError(w, http.StatusInternalServerError, "Failed to render template: "+err.Error())
+		return
+	}
+}
+
+// DeleteFile handles file deletion API requests
+func (h *FileBrowserHandlers) DeleteFile(w http.ResponseWriter, r *http.Request) {
+	var request struct {
+		Path string `json:"path" binding:"required"`
+	}
+
+	if err := decodeJSONBody(newJSONMaxReader(w, r), &request); err != nil {
+		writeJSONError(w, http.StatusBadRequest, "Invalid request: "+err.Error())
+		return
+	}
+
+	if strings.TrimSpace(request.Path) == "" {
+		writeJSONError(w, http.StatusBadRequest, "path is required")
+		return
+	}
+
+	// Delete file via filer
+	err := h.adminServer.WithFilerClient(func(client filer_pb.SeaweedFilerClient) error {
+		return filer_pb.DoRemove(context.Background(), client, path.Dir(request.Path), path.Base(request.Path), true, true, false, false, nil)
+	})
+	if err != nil {
+		writeJSONError(w, http.StatusInternalServerError, "Failed to delete file: "+err.Error())
+		return
+	}
+
+	writeJSON(w, http.StatusOK, map[string]interface{}{"message": "File deleted successfully"})
+}
+
+// DeleteMultipleFiles handles multiple file deletion API requests
+func (h *FileBrowserHandlers) DeleteMultipleFiles(w http.ResponseWriter, r *http.Request) {
+	var request struct {
+		Paths []string `json:"paths" binding:"required"`
+	}
+
+	if err := decodeJSONBody(newJSONMaxReader(w, r), &request); err != nil {
+		writeJSONError(w, http.StatusBadRequest, "Invalid request: "+err.Error())
+		return
+	}
+
+	if len(request.Paths) == 0 {
+		writeJSONError(w, http.StatusBadRequest, "No paths provided")
+		return
+	}
+
+	for _, p := range request.Paths {
+		if strings.TrimSpace(p) == "" {
+			writeJSONError(w, http.StatusBadRequest, "path is required")
+			return
+		}
+	}
+
+	var deletedCount int
+	var failedCount int
+	var errors []string
+
+	// Delete each file/folder
+	for _, p := range request.Paths {
+		err := h.adminServer.WithFilerClient(func(client filer_pb.SeaweedFilerClient) error {
+			return filer_pb.DoRemove(context.Background(), client, path.Dir(p), path.Base(p), true, true, false, false, nil)
+		})
+
+		if err != nil {
+			failedCount++
+			errors = append(errors, fmt.Sprintf("%s: %v", p, err))
+		} else {
+			deletedCount++
+		}
+	}
+
+	// Prepare response
+	response := map[string]interface{}{
+		"deleted": deletedCount,
+		"failed":  failedCount,
+		"total":   len(request.Paths),
+	}
+
+	if len(errors) > 0 {
+		response["errors"] = errors
+	}
+
+	if deletedCount > 0 {
+		if failedCount == 0 {
+			response["message"] = fmt.Sprintf("Successfully deleted %d item(s)", deletedCount)
+		} else {
+			response["message"] = fmt.Sprintf("Deleted %d item(s), failed to delete %d item(s)", deletedCount, failedCount)
+		}
+		writeJSON(w, http.StatusOK, response)
+	} else {
+		response["message"] = "Failed to delete all selected items"
+		writeJSON(w, http.StatusInternalServerError, response)
+	}
+}
+
+// CreateFolder handles folder creation requests
+func (h *FileBrowserHandlers) CreateFolder(w http.ResponseWriter, r *http.Request) {
+	var request struct {
+		Path       string `json:"path" binding:"required"`
+		FolderName string `json:"folder_name" binding:"required"`
+	}
+
+	if err := decodeJSONBody(newJSONMaxReader(w, r), &request); err != nil {
+		writeJSONError(w, http.StatusBadRequest, "Invalid request: "+err.Error())
+		return
+	}
+
+	if strings.TrimSpace(request.Path) == "" {
+		writeJSONError(w, http.StatusBadRequest, "path is required")
+		return
+	}
+
+	// Clean and validate folder name
+	folderName := strings.TrimSpace(request.FolderName)
+	if folderName == "" || strings.Contains(folderName, "/") || strings.Contains(folderName, "\\") {
+		writeJSONError(w, http.StatusBadRequest, "Invalid folder name")
+		return
+	}
+
+	// Create full path for new folder
+	base := "/" + strings.TrimPrefix(request.Path, "/")
+	fullPath := path.Join(base, folderName)
+
+	// Create folder via filer
+	err := h.adminServer.WithFilerClient(func(client filer_pb.SeaweedFilerClient) error {
+		_, err := client.CreateEntry(context.Background(), &filer_pb.CreateEntryRequest{
+			Directory: path.Dir(fullPath),
+			Entry: &filer_pb.Entry{
+				Name:        path.Base(fullPath),
+				IsDirectory: true,
+				Attributes: &filer_pb.FuseAttributes{
+					FileMode: uint32(0o755 | os.ModeDir), // Directory mode
+					Uid:      filer_pb.OS_UID,
+					Gid:      filer_pb.OS_GID,
+					Crtime:   time.Now().Unix(),
+					Mtime:    time.Now().Unix(),
+					TtlSec:   0,
+				},
+			},
+		})
+		return err
+	})
+	if err != nil {
+		writeJSONError(w, http.StatusInternalServerError, "Failed to create folder: "+err.Error())
+		return
+	}
+
+	writeJSON(w, http.StatusOK, map[string]interface{}{"message": "Folder created successfully"})
+}
+
+// UploadFile handles file upload requests
+func (h *FileBrowserHandlers) UploadFile(w http.ResponseWriter, r *http.Request) {
+	// Get the current path
+	currentPath := r.FormValue("path")
+	if currentPath == "" {
+		currentPath = "/"
+	}
+
+	// Parse multipart form
+	err := r.ParseMultipartForm(1 << 30) // 1GB max memory for large file uploads
+	if err != nil {
+		writeJSONError(w, http.StatusBadRequest, "Failed to parse multipart form: "+err.Error())
+		return
+	}
+
+	// Get uploaded files (supports multiple files)
+	files := r.MultipartForm.File["files"]
+	if len(files) == 0 {
+		writeJSONError(w, http.StatusBadRequest, "No files uploaded")
+		return
+	}
+
+	var uploadResults []map[string]interface{}
+	var failedUploads []string
+
+	// Process each uploaded file
+	for _, fileHeader := range files {
+		// Validate file name
+		fileName := fileHeader.Filename
+		if fileName == "" {
+			failedUploads = append(failedUploads, "invalid filename")
+			continue
+		}
+
+		// Normalize Windows-style backslashes to forward slashes
+		fileName = util.CleanWindowsPath(fileName)
+
+		// Create full path for the file using path.Join for URL path semantics
+		// path.Join handles double slashes and is not OS-specific like filepath.Join
+		fullPath := path.Join(currentPath, fileName)
+		if !strings.HasPrefix(fullPath, "/") {
+			fullPath = "/" + fullPath
+		}
+
+		// Upload file to filer
+		err = h.uploadFileToFiler(r.Context(), fullPath, fileHeader)
+
+		if err != nil {
+			failedUploads = append(failedUploads, fmt.Sprintf("%s: %v", fileName, err))
+		} else {
+			uploadResults = append(uploadResults, map[string]interface{}{
+				"name": fileName,
+				"size": fileHeader.Size,
+				"path": fullPath,
+			})
+		}
+	}
+
+	// Prepare response
+	response := map[string]interface{}{
+		"uploaded": len(uploadResults),
+		"failed":   len(failedUploads),
+		"files":    uploadResults,
+	}
+
+	if len(failedUploads) > 0 {
+		response["errors"] = failedUploads
+	}
+
+	if len(uploadResults) > 0 {
+		if len(failedUploads) == 0 {
+			response["message"] = fmt.Sprintf("Successfully uploaded %d file(s)", len(uploadResults))
+		} else {
+			response["message"] = fmt.Sprintf("Uploaded %d file(s), %d failed", len(uploadResults), len(failedUploads))
+		}
+		writeJSON(w, http.StatusOK, response)
+	} else {
+		response["message"] = "All file uploads failed"
+		writeJSON(w, http.StatusInternalServerError, response)
+	}
+}
+
+// uploadFileToFiler uploads a file to the cluster via filer gRPC + volume
+// HTTP. This works whether or not the filer is running with -disableHttp=true,
+// since the bytes never traverse the filer's HTTP listener. The multipart
+// file is streamed through the chunked uploader, so the admin process never
+// buffers the entire payload in memory. The caller passes the request
+// context so a client disconnect cancels the in-flight chunk uploads instead
+// of letting them run to completion against the volume servers.
+func (h *FileBrowserHandlers) uploadFileToFiler(ctx context.Context, filePath string, fileHeader *multipart.FileHeader) error {
+	file, err := fileHeader.Open()
+	if err != nil {
+		return fmt.Errorf("failed to open file: %w", err)
+	}
+	defer file.Close()
+
+	return h.uploadFileGrpc(ctx, filePath, fileHeader.Filename, fileHeader.Header.Get("Content-Type"), file)
+}
+
+// validateAndCleanFilePath validates and cleans the file path to prevent path traversal
+func (h *FileBrowserHandlers) validateAndCleanFilePath(filePath string) (string, error) {
+	if filePath == "" {
+		return "", fmt.Errorf("file path cannot be empty")
+	}
+
+	// Normalize Windows-style backslashes to forward slashes
+	filePath = util.CleanWindowsPath(filePath)
+
+	// Clean the path to remove any .. or . components
+	// Use path.Clean (not filepath.Clean) since this is a URL path
+	cleanPath := path.Clean(filePath)
+
+	// Ensure the path starts with /
+	if !strings.HasPrefix(cleanPath, "/") {
+		cleanPath = "/" + cleanPath
+	}
+
+	// Prevent path traversal attacks
+	if strings.Contains(cleanPath, "..") {
+		return "", fmt.Errorf("path traversal not allowed")
+	}
+
+	return cleanPath, nil
+}
+
+// fetchFileContent fetches file content via the filer gRPC service. It is
+// used for the "view as text" path, so the maxBytes cap matches the 1 MB
+// limit the caller already applies before invoking us.
+func (h *FileBrowserHandlers) fetchFileContent(filePath string, timeout time.Duration) (string, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), timeout)
+	defer cancel()
+	return h.fetchFileContentGrpc(ctx, filePath, 0)
+}
+
+// DownloadFile streams a file straight from the volume servers via the filer
+// gRPC service, so the admin file browser keeps working even when the filer
+// is started with -disableHttp=true.
+func (h *FileBrowserHandlers) DownloadFile(w http.ResponseWriter, r *http.Request) {
+	filePath := r.URL.Query().Get("path")
+	if filePath == "" {
+		writeJSONError(w, http.StatusBadRequest, "File path is required")
+		return
+	}
+	inline := r.URL.Query().Get("inline") == "true"
+	tracker := &responseWriteTracker{ResponseWriter: w}
+	if err := h.downloadFileGrpc(r.Context(), filePath, tracker, inline); err != nil {
+		// Once bytes have been written we can't switch to a JSON error body
+		// without corrupting the partial response — log and stop. Before any
+		// write the response is still uncommitted, so a 502 with details is
+		// safe.
+		if tracker.committed {
+			glog.Errorf("Error streaming file download: %v", err)
+			return
+		}
+		writeJSONError(w, http.StatusBadGateway, "Failed to fetch file: "+err.Error())
+	}
+}
+
+// responseWriteTracker wraps http.ResponseWriter to record whether the
+// response has been committed (status line + headers sent). DownloadFile
+// uses this instead of probing Header() so future header-setting code
+// reorganization can't silently break the "did we already send bytes?"
+// detection.
+type responseWriteTracker struct {
+	http.ResponseWriter
+	committed bool
+}
+
+func (t *responseWriteTracker) WriteHeader(code int) {
+	t.committed = true
+	t.ResponseWriter.WriteHeader(code)
+}
+
+func (t *responseWriteTracker) Write(p []byte) (int, error) {
+	t.committed = true
+	return t.ResponseWriter.Write(p)
+}
+
+// ViewFile handles file viewing requests (for text files, images, etc.)
+func (h *FileBrowserHandlers) ViewFile(w http.ResponseWriter, r *http.Request) {
+	filePath := r.URL.Query().Get("path")
+	if filePath == "" {
+		writeJSONError(w, http.StatusBadRequest, "File path is required")
+		return
+	}
+
+	// Get file metadata first
+	var fileEntry dash.FileEntry
+	err := h.adminServer.WithFilerClient(func(client filer_pb.SeaweedFilerClient) error {
+		resp, err := client.LookupDirectoryEntry(context.Background(), &filer_pb.LookupDirectoryEntryRequest{
+			Directory: path.Dir(filePath),
+			Name:      path.Base(filePath),
+		})
+		if err != nil {
+			return err
+		}
+
+		entry := resp.Entry
+		if entry == nil {
+			return fmt.Errorf("file not found")
+		}
+
+		// Convert to FileEntry
+		var modTime time.Time
+		if entry.Attributes != nil && entry.Attributes.Mtime > 0 {
+			modTime = time.Unix(entry.Attributes.Mtime, 0)
+		}
+
+		var size int64
+		if entry.Attributes != nil {
+			size = int64(entry.Attributes.FileSize)
+		}
+
+		mime := dash.ResolveEntryMime(entry)
+
+		fileEntry = dash.FileEntry{
+			Name:        entry.Name,
+			FullPath:    filePath,
+			IsDirectory: entry.IsDirectory,
+			Size:        size,
+			ModTime:     modTime,
+			Mime:        mime,
+		}
+
+		return nil
+	})
+	if err != nil {
+		writeJSONError(w, http.StatusInternalServerError, "Failed to get file metadata: "+err.Error())
+		return
+	}
+
+	// Check if file is viewable as text
+	var content string
+	var viewable bool
+	var reason string
+
+	// First check if it's a known text type or if we should check content
+	isKnownTextType := strings.HasPrefix(fileEntry.Mime, "text/") ||
+		fileEntry.Mime == "application/json" ||
+		fileEntry.Mime == "application/javascript" ||
+		fileEntry.Mime == "application/xml"
+
+	// For unknown types, check if it might be text by content
+	if !isKnownTextType && fileEntry.Mime == "application/octet-stream" {
+		isKnownTextType = h.isLikelyTextFile(filePath, 512)
+		if isKnownTextType {
+			// Update MIME type for better display
+			fileEntry.Mime = "text/plain"
+		}
+	}
+
+	if isKnownTextType {
+		// Limit text file size for viewing (max 1MB)
+		if fileEntry.Size > 1024*1024 {
+			viewable = false
+			reason = "File too large for viewing (>1MB)"
+		} else {
+			// Fetch file content from filer
+			var err error
+			content, err = h.fetchFileContent(filePath, 30*time.Second)
+			if err != nil {
+				reason = err.Error()
+			}
+			viewable = (err == nil)
+		}
+	} else {
+		// Not a text file, but might be viewable as image or PDF
+		if strings.HasPrefix(fileEntry.Mime, "image/") || fileEntry.Mime == "application/pdf" {
+			viewable = true
+		} else {
+			viewable = false
+			reason = "File type not supported for viewing"
+		}
+	}
+
+	writeJSON(w, http.StatusOK, map[string]interface{}{
+		"file":     fileEntry,
+		"content":  content,
+		"viewable": viewable,
+		"reason":   reason,
+	})
+}
+
+// GetFileProperties handles file properties requests
+func (h *FileBrowserHandlers) GetFileProperties(w http.ResponseWriter, r *http.Request) {
+	filePath := r.URL.Query().Get("path")
+	if filePath == "" {
+		writeJSONError(w, http.StatusBadRequest, "File path is required")
+		return
+	}
+
+	// Get detailed file information from filer
+	var properties map[string]interface{}
+	err := h.adminServer.WithFilerClient(func(client filer_pb.SeaweedFilerClient) error {
+		resp, err := client.LookupDirectoryEntry(context.Background(), &filer_pb.LookupDirectoryEntryRequest{
+			Directory: path.Dir(filePath),
+			Name:      path.Base(filePath),
+		})
+		if err != nil {
+			return err
+		}
+
+		entry := resp.Entry
+		if entry == nil {
+			return fmt.Errorf("file not found")
+		}
+
+		properties = make(map[string]interface{})
+		properties["name"] = entry.Name
+		properties["full_path"] = filePath
+		properties["is_directory"] = entry.IsDirectory
+
+		if entry.Attributes != nil {
+			properties["size"] = entry.Attributes.FileSize
+			properties["size_formatted"] = h.formatBytes(int64(entry.Attributes.FileSize))
+
+			if entry.Attributes.Mtime > 0 {
+				modTime := time.Unix(entry.Attributes.Mtime, 0)
+				properties["modified_time"] = modTime.Format("2006-01-02 15:04:05")
+				properties["modified_timestamp"] = entry.Attributes.Mtime
+			}
+
+			if entry.Attributes.Crtime > 0 {
+				createTime := time.Unix(entry.Attributes.Crtime, 0)
+				properties["created_time"] = createTime.Format("2006-01-02 15:04:05")
+				properties["created_timestamp"] = entry.Attributes.Crtime
+			}
+
+			properties["file_mode"] = dash.FormatFileMode(entry.Attributes.FileMode)
+			properties["file_mode_formatted"] = dash.FormatFileMode(entry.Attributes.FileMode)
+			properties["file_mode_octal"] = fmt.Sprintf("%o", entry.Attributes.FileMode)
+			properties["uid"] = entry.Attributes.Uid
+			properties["gid"] = entry.Attributes.Gid
+			properties["ttl_seconds"] = entry.Attributes.TtlSec
+
+			if entry.Attributes.TtlSec > 0 {
+				properties["ttl_formatted"] = fmt.Sprintf("%d seconds", entry.Attributes.TtlSec)
+			}
+		}
+
+		// Get extended attributes
+		if entry.Extended != nil {
+			extended := make(map[string]string)
+			for key, value := range entry.Extended {
+				extended[key] = string(value)
+			}
+			properties["extended"] = extended
+		}
+
+		// Get chunk information for files
+		if !entry.IsDirectory && len(entry.Chunks) > 0 {
+			chunks := make([]map[string]interface{}, 0, len(entry.Chunks))
+			for _, chunk := range entry.Chunks {
+				chunkInfo := map[string]interface{}{
+					"file_id":     chunk.FileId,
+					"offset":      chunk.Offset,
+					"size":        chunk.Size,
+					"modified_ts": chunk.ModifiedTsNs,
+					"e_tag":       chunk.ETag,
+					"source_fid":  chunk.SourceFileId,
+				}
+				chunks = append(chunks, chunkInfo)
+			}
+			properties["chunks"] = chunks
+			properties["chunk_count"] = len(entry.Chunks)
+		}
+
+		if !entry.IsDirectory {
+			properties["mime_type"] = dash.ResolveEntryMime(entry)
+		}
+
+		return nil
+	})
+	if err != nil {
+		writeJSONError(w, http.StatusInternalServerError, "Failed to get file properties: "+err.Error())
+		return
+	}
+
+	if isDir, _ := properties["is_directory"].(bool); !isDir {
+		if objectURL := h.adminServer.GetS3ObjectURL(filePath); objectURL != "" {
+			properties["object_url"] = objectURL
+		}
+	}
+
+	writeJSON(w, http.StatusOK, properties)
+}
+
+// ExportMetadata streams a file or folder's metadata as a gzipped, length-prefixed
+// FullEntry stream — the format weed shell fs.meta.load reads. Directories are
+// walked recursively via the filer BFS metadata stream.
+func (h *FileBrowserHandlers) ExportMetadata(w http.ResponseWriter, r *http.Request) {
+	filePath := r.URL.Query().Get("path")
+	if filePath == "" {
+		writeJSONError(w, http.StatusBadRequest, "File path is required")
+		return
+	}
+	cleanPath, err := h.validateAndCleanFilePath(filePath)
+	if err != nil {
+		writeJSONError(w, http.StatusBadRequest, err.Error())
+		return
+	}
+
+	tracker := &responseWriteTracker{ResponseWriter: w}
+
+	err = h.adminServer.WithFilerClient(func(client filer_pb.SeaweedFilerClient) error {
+		stream, err := client.TraverseBfsMetadata(r.Context(), &filer_pb.TraverseBfsMetadataRequest{
+			Directory:        cleanPath,
+			ExcludedPrefixes: []string{filer.SystemLogDir},
+		})
+		if err != nil {
+			return err
+		}
+
+		// Read the first entry before sending headers so a bad path returns a clean error.
+		first, err := stream.Recv()
+		if err != nil {
+			return err
+		}
+
+		downloadName := path.Base(cleanPath)
+		if downloadName == "/" || downloadName == "." || downloadName == "" {
+			downloadName = "root"
+		}
+		tracker.Header().Set("Content-Type", "application/gzip")
+		tracker.Header().Set("Content-Disposition", mime.FormatMediaType("attachment", map[string]string{"filename": downloadName + ".meta.gz"}))
+		tracker.WriteHeader(http.StatusOK)
+
+		bw := bufio.NewWriter(tracker)
+		gw := gzip.NewWriter(bw)
+
+		sizeBuf := make([]byte, 4)
+		writeEntry := func(resp *filer_pb.TraverseBfsMetadataResponse) error {
+			b, err := proto.Marshal(&filer_pb.FullEntry{Dir: resp.Directory, Entry: resp.Entry})
+			if err != nil {
+				return err
+			}
+			util.Uint32toBytes(sizeBuf, uint32(len(b)))
+			if _, err := gw.Write(sizeBuf); err != nil {
+				return err
+			}
+			_, err = gw.Write(b)
+			return err
+		}
+
+		if err := writeEntry(first); err != nil {
+			return err
+		}
+		for {
+			resp, recvErr := stream.Recv()
+			if recvErr == io.EOF {
+				break
+			}
+			if recvErr != nil {
+				return recvErr
+			}
+			if err := writeEntry(resp); err != nil {
+				return err
+			}
+		}
+
+		if err := gw.Close(); err != nil {
+			return err
+		}
+		return bw.Flush()
+	})
+	if err != nil {
+		if tracker.committed {
+			glog.Errorf("Error exporting metadata for %s: %v", cleanPath, err)
+			return
+		}
+		writeJSONError(w, http.StatusInternalServerError, "Failed to export metadata: "+err.Error())
+	}
+}
+
+// Helper function to format bytes
+func (h *FileBrowserHandlers) formatBytes(bytes int64) string {
+	const unit = 1024
+	if bytes < unit {
+		return fmt.Sprintf("%d B", bytes)
+	}
+	div, exp := int64(unit), 0
+	for n := bytes / unit; n >= unit; n /= unit {
+		div *= unit
+		exp++
+	}
+	return fmt.Sprintf("%.1f %cB", float64(bytes)/float64(div), "KMGTPE"[exp])
+}
+
+// Helper function to check if a file is likely a text file by checking content
+func (h *FileBrowserHandlers) isLikelyTextFile(filePath string, maxCheckSize int64) bool {
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+	content, err := h.fetchFileContentGrpc(ctx, filePath, int(maxCheckSize))
+	if err != nil {
+		return false
+	}
+	if len(content) == 0 {
+		return true
+	}
+	return h.isPrintableText([]byte(content))
+}
+
+// Helper function to check if content is printable text
+func (h *FileBrowserHandlers) isPrintableText(data []byte) bool {
+	if len(data) == 0 {
+		return true
+	}
+
+	// Count printable characters
+	printable := 0
+	for _, b := range data {
+		if b >= 32 && b <= 126 || b == 9 || b == 10 || b == 13 {
+			// Printable ASCII, tab, newline, carriage return
+			printable++
+		} else if b >= 128 {
+			// Potential UTF-8 character
+			printable++
+		}
+	}
+
+	// If more than 95% of characters are printable, consider it text
+	return float64(printable)/float64(len(data)) > 0.95
+}
+
+// Helper function for min
+func min(a, b int64) int64 {
+	if a < b {
+		return a
+	}
+	return b
+}
+
+// maxListFoldersEntries caps how many subfolder names ListFolders will
+// collect for a single request, so a directory with an unusually large
+// number of children can't turn one autocomplete keystroke into an
+// unbounded, slow full-directory walk.
+const maxListFoldersEntries = 2000
+
+// maxListFoldersScanned caps how many entries ListFolders will page through
+// looking for those subfolders. The folder cap alone doesn't bound the work:
+// a bucket holding nothing but flat object keys has no subfolders to count,
+// so the walk runs to the end of the directory - a million keys is a million
+// entries read, 200 per round trip, behind a single keystroke.
+const maxListFoldersScanned = 10000
+
+// ListFolders returns, as JSON, the names of the subdirectories directly
+// under the given path. It exists to back progressive autocomplete (e.g. the
+// policy editor's Resource ARN field building up "bucket/folder/subfolder"
+// one path segment at a time) rather than to be a general directory listing
+// API, so it's restricted to paths under /buckets. The optional prefix is the
+// segment the caller is still typing, and narrows the listing to it.
+func (h *FileBrowserHandlers) ListFolders(w http.ResponseWriter, r *http.Request) {
+	dirPath := defaultQuery(r.URL.Query().Get("path"), "/buckets")
+	// Clean before the scope check: CleanWindowsPath only rewrites backslashes,
+	// so "/buckets/../etc" would otherwise satisfy the prefix test below.
+	dirPath = path.Clean(util.CleanWindowsPath(dirPath))
+
+	if dirPath != "/buckets" && !strings.HasPrefix(dirPath, "/buckets/") {
+		writeJSONError(w, http.StatusBadRequest, "path must be under /buckets")
+		return
+	}
+
+	prefix := r.URL.Query().Get("prefix")
+
+	folders := []string{}
+	lastFileName := ""
+	scanned := 0
+	for {
+		browserData, err := h.adminServer.GetFileBrowser(dirPath, prefix, lastFileName, 200)
+		if err != nil {
+			writeJSONError(w, http.StatusInternalServerError, "Failed to list directory: "+err.Error())
+			return
+		}
+		scanned += len(browserData.Entries)
+		for _, entry := range browserData.Entries {
+			if entry.IsDirectory {
+				folders = append(folders, entry.Name)
+				if len(folders) >= maxListFoldersEntries {
+					break
+				}
+			}
+		}
+		if len(browserData.Entries) == 0 || !browserData.HasNextPage ||
+			len(folders) >= maxListFoldersEntries || scanned >= maxListFoldersScanned {
+			break
+		}
+		lastFileName = browserData.Entries[len(browserData.Entries)-1].Name
+	}
+
+	writeJSON(w, http.StatusOK, map[string]interface{}{"folders": folders})
+}

weed/admin/handlers/file_browser_handlers_test.go

@@ -0,0 +1,65 @@
+package handlers
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/admin/dash"
+)
+
+func TestValidateAndCleanFilePath_AllowsControlChars(t *testing.T) {
+	h := &FileBrowserHandlers{}
+
+	// S3 object keys may legally contain any UTF-8 bytes, including control
+	// characters like \n, \r, and \x00. The admin UI must be able to browse
+	// and manage such entries rather than silently stripping or rejecting them.
+	cases := []struct {
+		in   string
+		want string
+	}{
+		{"/buckets/profilebuilder/3testGB.zip\n ", "/buckets/profilebuilder/3testGB.zip\n "},
+		{"/foo\rbar", "/foo\rbar"},
+		{"/foo\x00bar", "/foo\x00bar"},
+		{"/normal/path.txt", "/normal/path.txt"},
+		// Missing leading slash should be added back.
+		{"relative/path.txt", "/relative/path.txt"},
+		// Duplicate slashes should be collapsed by path.Clean.
+		{"/a//b", "/a/b"},
+	}
+	for _, tc := range cases {
+		got, err := h.validateAndCleanFilePath(tc.in)
+		if err != nil {
+			t.Errorf("validateAndCleanFilePath(%q) unexpected error: %v", tc.in, err)
+			continue
+		}
+		if got != tc.want {
+			t.Errorf("validateAndCleanFilePath(%q) = %q, want %q", tc.in, got, tc.want)
+		}
+	}
+}
+
+func TestValidateAndCleanFilePath_RejectsEmpty(t *testing.T) {
+	h := &FileBrowserHandlers{}
+	if _, err := h.validateAndCleanFilePath(""); err == nil {
+		t.Errorf("expected empty path rejection")
+	}
+}
+
+func TestListFolders_RejectsPathOutsideBuckets(t *testing.T) {
+	h := &FileBrowserHandlers{adminServer: &dash.AdminServer{}}
+
+	cases := []string{"/etc/seaweedfs", "/", "/notbuckets/foo", "/buckets-not-really/foo",
+		"/buckets/../etc", "/buckets/..", "/buckets/foo/../../etc", `/buckets\..\etc`}
+	for _, path := range cases {
+		req := httptest.NewRequest(http.MethodGet, "/api/files/list-folders?path="+path, nil)
+		w := httptest.NewRecorder()
+
+		h.ListFolders(w, req)
+
+		if w.Code != http.StatusBadRequest {
+			t.Errorf("path %q: expected 400, got %d (body: %s)", path, w.Code, w.Body.String())
+		}
+	}
+}
+

weed/admin/handlers/group_handlers.go

@@ -0,0 +1,271 @@
+package handlers
+
+import (
+	"bytes"
+	"errors"
+	"net/http"
+	"time"
+
+	"github.com/gorilla/mux"
+	"github.com/seaweedfs/seaweedfs/weed/admin/dash"
+	"github.com/seaweedfs/seaweedfs/weed/admin/view/app"
+	"github.com/seaweedfs/seaweedfs/weed/admin/view/layout"
+	"github.com/seaweedfs/seaweedfs/weed/credential"
+	"github.com/seaweedfs/seaweedfs/weed/glog"
+)
+
+func groupErrorToHTTPStatus(err error) int {
+	if errors.Is(err, credential.ErrGroupNotFound) {
+		return http.StatusNotFound
+	}
+	if errors.Is(err, credential.ErrGroupAlreadyExists) {
+		return http.StatusConflict
+	}
+	if errors.Is(err, credential.ErrUserNotInGroup) {
+		return http.StatusBadRequest
+	}
+	if errors.Is(err, credential.ErrPolicyNotAttached) {
+		return http.StatusBadRequest
+	}
+	if errors.Is(err, credential.ErrUserNotFound) {
+		return http.StatusNotFound
+	}
+	if errors.Is(err, credential.ErrPolicyNotFound) {
+		return http.StatusNotFound
+	}
+	if errors.Is(err, credential.ErrGroupNotEmpty) {
+		return http.StatusConflict
+	}
+	return http.StatusInternalServerError
+}
+
+type GroupHandlers struct {
+	adminServer *dash.AdminServer
+}
+
+func NewGroupHandlers(adminServer *dash.AdminServer) *GroupHandlers {
+	return &GroupHandlers{adminServer: adminServer}
+}
+
+func (h *GroupHandlers) ShowGroups(w http.ResponseWriter, r *http.Request) {
+	data, err := h.getGroupsPageData(r)
+	if err != nil {
+		glog.Errorf("Failed to get groups data: %v", err)
+		writeJSONError(w, http.StatusInternalServerError, "Failed to load groups: "+err.Error())
+		return
+	}
+
+	var buf bytes.Buffer
+	component := app.Groups(data)
+	viewCtx := layout.NewViewContext(r, dash.UsernameFromContext(r.Context()), dash.CSRFTokenFromContext(r.Context()))
+	layoutComponent := layout.Layout(viewCtx, component)
+	if err := layoutComponent.Render(r.Context(), &buf); err != nil {
+		glog.Errorf("Failed to render groups template: %v", err)
+		w.WriteHeader(http.StatusInternalServerError)
+		return
+	}
+	w.Header().Set("Content-Type", "text/html")
+	_, _ = w.Write(buf.Bytes())
+}
+
+func (h *GroupHandlers) GetGroups(w http.ResponseWriter, r *http.Request) {
+	groups, err := h.adminServer.GetGroups(r.Context())
+	if err != nil {
+		glog.Errorf("Failed to get groups: %v", err)
+		writeJSONError(w, http.StatusInternalServerError, "Failed to get groups")
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]interface{}{"groups": groups})
+}
+
+func (h *GroupHandlers) CreateGroup(w http.ResponseWriter, r *http.Request) {
+	var req dash.CreateGroupRequest
+	if err := decodeJSONBody(newJSONMaxReader(w, r), &req); err != nil {
+		writeJSONError(w, http.StatusBadRequest, "Invalid request: "+err.Error())
+		return
+	}
+	if req.Name == "" {
+		writeJSONError(w, http.StatusBadRequest, "Group name is required")
+		return
+	}
+	group, err := h.adminServer.CreateGroup(r.Context(), req.Name)
+	if err != nil {
+		glog.Errorf("Failed to create group: %v", err)
+		writeJSONError(w, groupErrorToHTTPStatus(err), "Failed to create group: "+err.Error())
+		return
+	}
+	writeJSON(w, http.StatusOK, group)
+}
+
+func (h *GroupHandlers) GetGroupDetails(w http.ResponseWriter, r *http.Request) {
+	name := mux.Vars(r)["name"]
+	group, err := h.adminServer.GetGroupDetails(r.Context(), name)
+	if err != nil {
+		glog.Errorf("Failed to get group details: %v", err)
+		status := groupErrorToHTTPStatus(err)
+		msg := "Failed to retrieve group"
+		if status == http.StatusNotFound {
+			msg = "Group not found"
+		}
+		writeJSONError(w, status, msg)
+		return
+	}
+	writeJSON(w, http.StatusOK, group)
+}
+
+func (h *GroupHandlers) DeleteGroup(w http.ResponseWriter, r *http.Request) {
+	name := mux.Vars(r)["name"]
+	if err := h.adminServer.DeleteGroup(r.Context(), name); err != nil {
+		glog.Errorf("Failed to delete group: %v", err)
+		writeJSONError(w, groupErrorToHTTPStatus(err), "Failed to delete group: "+err.Error())
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]string{"message": "Group deleted successfully"})
+}
+
+func (h *GroupHandlers) GetGroupMembers(w http.ResponseWriter, r *http.Request) {
+	name := mux.Vars(r)["name"]
+	group, err := h.adminServer.GetGroupDetails(r.Context(), name)
+	if err != nil {
+		writeJSONError(w, groupErrorToHTTPStatus(err), "Failed to get group: "+err.Error())
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]interface{}{"members": group.Members})
+}
+
+func (h *GroupHandlers) AddGroupMember(w http.ResponseWriter, r *http.Request) {
+	name := mux.Vars(r)["name"]
+	var req struct {
+		Username string `json:"username"`
+	}
+	if err := decodeJSONBody(newJSONMaxReader(w, r), &req); err != nil {
+		writeJSONError(w, http.StatusBadRequest, "Invalid request: "+err.Error())
+		return
+	}
+	if req.Username == "" {
+		writeJSONError(w, http.StatusBadRequest, "Username is required")
+		return
+	}
+	if err := h.adminServer.AddGroupMember(r.Context(), name, req.Username); err != nil {
+		writeJSONError(w, groupErrorToHTTPStatus(err), "Failed to add member: "+err.Error())
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]string{"message": "Member added successfully"})
+}
+
+func (h *GroupHandlers) RemoveGroupMember(w http.ResponseWriter, r *http.Request) {
+	name := mux.Vars(r)["name"]
+	username := mux.Vars(r)["username"]
+	if err := h.adminServer.RemoveGroupMember(r.Context(), name, username); err != nil {
+		writeJSONError(w, groupErrorToHTTPStatus(err), "Failed to remove member: "+err.Error())
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]string{"message": "Member removed successfully"})
+}
+
+func (h *GroupHandlers) GetGroupPolicies(w http.ResponseWriter, r *http.Request) {
+	name := mux.Vars(r)["name"]
+	group, err := h.adminServer.GetGroupDetails(r.Context(), name)
+	if err != nil {
+		writeJSONError(w, groupErrorToHTTPStatus(err), "Failed to get group: "+err.Error())
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]interface{}{"policies": group.PolicyNames})
+}
+
+func (h *GroupHandlers) AttachGroupPolicy(w http.ResponseWriter, r *http.Request) {
+	name := mux.Vars(r)["name"]
+	var req struct {
+		PolicyName string `json:"policy_name"`
+	}
+	if err := decodeJSONBody(newJSONMaxReader(w, r), &req); err != nil {
+		writeJSONError(w, http.StatusBadRequest, "Invalid request: "+err.Error())
+		return
+	}
+	if req.PolicyName == "" {
+		writeJSONError(w, http.StatusBadRequest, "Policy name is required")
+		return
+	}
+	if err := h.adminServer.AttachGroupPolicy(r.Context(), name, req.PolicyName); err != nil {
+		writeJSONError(w, groupErrorToHTTPStatus(err), "Failed to attach policy: "+err.Error())
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]string{"message": "Policy attached successfully"})
+}
+
+func (h *GroupHandlers) DetachGroupPolicy(w http.ResponseWriter, r *http.Request) {
+	name := mux.Vars(r)["name"]
+	policyName := mux.Vars(r)["policyName"]
+	if err := h.adminServer.DetachGroupPolicy(r.Context(), name, policyName); err != nil {
+		writeJSONError(w, groupErrorToHTTPStatus(err), "Failed to detach policy: "+err.Error())
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]string{"message": "Policy detached successfully"})
+}
+
+func (h *GroupHandlers) SetGroupStatus(w http.ResponseWriter, r *http.Request) {
+	name := mux.Vars(r)["name"]
+	var req struct {
+		Enabled *bool `json:"enabled"`
+	}
+	if err := decodeJSONBody(newJSONMaxReader(w, r), &req); err != nil {
+		writeJSONError(w, http.StatusBadRequest, "Invalid request: "+err.Error())
+		return
+	}
+	if req.Enabled == nil {
+		writeJSONError(w, http.StatusBadRequest, "enabled field is required")
+		return
+	}
+	if err := h.adminServer.SetGroupStatus(r.Context(), name, *req.Enabled); err != nil {
+		writeJSONError(w, groupErrorToHTTPStatus(err), "Failed to update group status: "+err.Error())
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]string{"message": "Group status updated"})
+}
+
+func (h *GroupHandlers) getGroupsPageData(r *http.Request) (dash.GroupsPageData, error) {
+	username := dash.UsernameFromContext(r.Context())
+	if username == "" {
+		username = "admin"
+	}
+
+	groups, err := h.adminServer.GetGroups(r.Context())
+	if err != nil {
+		return dash.GroupsPageData{}, err
+	}
+
+	activeCount := 0
+	for _, g := range groups {
+		if g.Status == "enabled" {
+			activeCount++
+		}
+	}
+
+	// Get available users for dropdown
+	var availableUsers []string
+	users, err := h.adminServer.GetObjectStoreUsers(r.Context())
+	if err == nil {
+		for _, user := range users {
+			availableUsers = append(availableUsers, user.Username)
+		}
+	}
+
+	// Get available policies for dropdown
+	var availablePolicies []string
+	policies, err := h.adminServer.GetPolicies()
+	if err == nil {
+		for _, p := range policies {
+			availablePolicies = append(availablePolicies, p.Name)
+		}
+	}
+
+	return dash.GroupsPageData{
+		Username:          username,
+		Groups:            groups,
+		TotalGroups:       len(groups),
+		ActiveGroups:      activeCount,
+		AvailableUsers:    availableUsers,
+		AvailablePolicies: availablePolicies,
+		LastUpdated:       time.Now(),
+	}, nil
+}

weed/admin/handlers/http_helpers.go

@@ -0,0 +1,28 @@
+package handlers
+
+import (
+	"io"
+	"net/http"
+
+	"github.com/seaweedfs/seaweedfs/weed/admin/internal/httputil"
+)
+
+func writeJSON(w http.ResponseWriter, status int, payload interface{}) {
+	httputil.WriteJSON(w, status, payload)
+}
+
+func writeJSONError(w http.ResponseWriter, status int, message string) {
+	httputil.WriteJSONError(w, status, message)
+}
+
+func decodeJSONBody(r io.Reader, v interface{}) error {
+	return httputil.DecodeJSONBody(r, v)
+}
+
+func newJSONMaxReader(w http.ResponseWriter, r *http.Request) io.Reader {
+	return httputil.NewJSONMaxReader(w, r)
+}
+
+func defaultQuery(value, fallback string) string {
+	return httputil.DefaultQuery(value, fallback)
+}

weed/admin/handlers/mq_handlers.go

@@ -0,0 +1,216 @@
+package handlers
+
+import (
+	"fmt"
+	"net/http"
+
+	"github.com/gorilla/mux"
+	"github.com/seaweedfs/seaweedfs/weed/admin/dash"
+	"github.com/seaweedfs/seaweedfs/weed/admin/view/app"
+	"github.com/seaweedfs/seaweedfs/weed/admin/view/layout"
+)
+
+// MessageQueueHandlers contains all the HTTP handlers for message queue management
+type MessageQueueHandlers struct {
+	adminServer *dash.AdminServer
+}
+
+// NewMessageQueueHandlers creates a new instance of MessageQueueHandlers
+func NewMessageQueueHandlers(adminServer *dash.AdminServer) *MessageQueueHandlers {
+	return &MessageQueueHandlers{
+		adminServer: adminServer,
+	}
+}
+
+// ShowBrokers renders the message queue brokers page
+func (h *MessageQueueHandlers) ShowBrokers(w http.ResponseWriter, r *http.Request) {
+	// Get cluster brokers data
+	brokersData, err := h.adminServer.GetClusterBrokers()
+	if err != nil {
+		writeJSONError(w, http.StatusInternalServerError, "Failed to get cluster brokers: "+err.Error())
+		return
+	}
+
+	// Set username
+	username := dash.UsernameFromContext(r.Context())
+	if username == "" {
+		username = "admin"
+	}
+	brokersData.Username = username
+
+	// Render HTML template
+	w.Header().Set("Content-Type", "text/html")
+	brokersComponent := app.ClusterBrokers(*brokersData)
+	viewCtx := layout.NewViewContext(r, username, dash.CSRFTokenFromContext(r.Context()))
+	layoutComponent := layout.Layout(viewCtx, brokersComponent)
+	err = layoutComponent.Render(r.Context(), w)
+	if err != nil {
+		writeJSONError(w, http.StatusInternalServerError, "Failed to render template: "+err.Error())
+		return
+	}
+}
+
+// ShowTopics renders the message queue topics page
+func (h *MessageQueueHandlers) ShowTopics(w http.ResponseWriter, r *http.Request) {
+	// Get topics data
+	topicsData, err := h.adminServer.GetTopics()
+	if err != nil {
+		writeJSONError(w, http.StatusInternalServerError, "Failed to get topics: "+err.Error())
+		return
+	}
+
+	// Set username
+	username := dash.UsernameFromContext(r.Context())
+	if username == "" {
+		username = "admin"
+	}
+	topicsData.Username = username
+
+	// Render HTML template
+	w.Header().Set("Content-Type", "text/html")
+	topicsComponent := app.Topics(*topicsData)
+	viewCtx := layout.NewViewContext(r, username, dash.CSRFTokenFromContext(r.Context()))
+	layoutComponent := layout.Layout(viewCtx, topicsComponent)
+	err = layoutComponent.Render(r.Context(), w)
+	if err != nil {
+		writeJSONError(w, http.StatusInternalServerError, "Failed to render template: "+err.Error())
+		return
+	}
+}
+
+// ShowTopicDetails renders the topic details page
+func (h *MessageQueueHandlers) ShowTopicDetails(w http.ResponseWriter, r *http.Request) {
+	// Get topic parameters from URL
+	vars := mux.Vars(r)
+	namespace := vars["namespace"]
+	topicName := vars["topic"]
+
+	if namespace == "" || topicName == "" {
+		writeJSONError(w, http.StatusBadRequest, "Missing namespace or topic name")
+		return
+	}
+
+	// Get topic details data
+	topicDetailsData, err := h.adminServer.GetTopicDetails(namespace, topicName)
+	if err != nil {
+		writeJSONError(w, http.StatusInternalServerError, "Failed to get topic details: "+err.Error())
+		return
+	}
+
+	// Set username
+	username := dash.UsernameFromContext(r.Context())
+	if username == "" {
+		username = "admin"
+	}
+	topicDetailsData.Username = username
+
+	// Render HTML template
+	w.Header().Set("Content-Type", "text/html")
+	topicDetailsComponent := app.TopicDetails(*topicDetailsData)
+	viewCtx := layout.NewViewContext(r, username, dash.CSRFTokenFromContext(r.Context()))
+	layoutComponent := layout.Layout(viewCtx, topicDetailsComponent)
+	err = layoutComponent.Render(r.Context(), w)
+	if err != nil {
+		writeJSONError(w, http.StatusInternalServerError, "Failed to render template: "+err.Error())
+		return
+	}
+}
+
+// GetTopicDetailsAPI returns topic details as JSON for AJAX calls
+func (h *MessageQueueHandlers) GetTopicDetailsAPI(w http.ResponseWriter, r *http.Request) {
+	// Get topic parameters from URL
+	vars := mux.Vars(r)
+	namespace := vars["namespace"]
+	topicName := vars["topic"]
+
+	if namespace == "" || topicName == "" {
+		writeJSONError(w, http.StatusBadRequest, "Missing namespace or topic name")
+		return
+	}
+
+	// Get topic details data
+	topicDetailsData, err := h.adminServer.GetTopicDetails(namespace, topicName)
+	if err != nil {
+		writeJSONError(w, http.StatusInternalServerError, "Failed to get topic details: "+err.Error())
+		return
+	}
+
+	// Return JSON data
+	writeJSON(w, http.StatusOK, topicDetailsData)
+}
+
+// CreateTopicAPI creates a new topic with retention configuration
+func (h *MessageQueueHandlers) CreateTopicAPI(w http.ResponseWriter, r *http.Request) {
+	var req struct {
+		Namespace      string `json:"namespace" binding:"required"`
+		Name           string `json:"name" binding:"required"`
+		PartitionCount int32  `json:"partition_count" binding:"required"`
+		Retention      struct {
+			Enabled          bool  `json:"enabled"`
+			RetentionSeconds int64 `json:"retention_seconds"`
+		} `json:"retention"`
+	}
+
+	if err := decodeJSONBody(newJSONMaxReader(w, r), &req); err != nil {
+		writeJSONError(w, http.StatusBadRequest, "Invalid request: "+err.Error())
+		return
+	}
+
+	// Validate inputs
+	if req.PartitionCount < 1 || req.PartitionCount > 100 {
+		writeJSONError(w, http.StatusBadRequest, "Partition count must be between 1 and 100")
+		return
+	}
+
+	if req.Retention.Enabled && req.Retention.RetentionSeconds <= 0 {
+		writeJSONError(w, http.StatusBadRequest, "Retention seconds must be positive when retention is enabled")
+		return
+	}
+
+	// Create the topic via admin server
+	err := h.adminServer.CreateTopicWithRetention(req.Namespace, req.Name, req.PartitionCount, req.Retention.Enabled, req.Retention.RetentionSeconds)
+	if err != nil {
+		writeJSONError(w, http.StatusInternalServerError, "Failed to create topic: "+err.Error())
+		return
+	}
+
+	writeJSON(w, http.StatusOK, map[string]interface{}{
+		"message": "Topic created successfully",
+		"topic":   fmt.Sprintf("%s.%s", req.Namespace, req.Name),
+	})
+}
+
+type UpdateTopicRetentionRequest struct {
+	Namespace string `json:"namespace"`
+	Name      string `json:"name"`
+	Retention struct {
+		Enabled          bool  `json:"enabled"`
+		RetentionSeconds int64 `json:"retention_seconds"`
+	} `json:"retention"`
+}
+
+func (h *MessageQueueHandlers) UpdateTopicRetentionAPI(w http.ResponseWriter, r *http.Request) {
+	var request UpdateTopicRetentionRequest
+	if err := decodeJSONBody(newJSONMaxReader(w, r), &request); err != nil {
+		writeJSONError(w, http.StatusBadRequest, err.Error())
+		return
+	}
+
+	// Validate required fields
+	if request.Namespace == "" || request.Name == "" {
+		writeJSONError(w, http.StatusBadRequest, "namespace and name are required")
+		return
+	}
+
+	// Update the topic retention
+	err := h.adminServer.UpdateTopicRetention(request.Namespace, request.Name, request.Retention.Enabled, request.Retention.RetentionSeconds)
+	if err != nil {
+		writeJSONError(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+
+	writeJSON(w, http.StatusOK, map[string]interface{}{
+		"message": "Topic retention updated successfully",
+		"topic":   request.Namespace + "." + request.Name,
+	})
+}

weed/admin/handlers/plugin_handlers.go

@@ -0,0 +1,136 @@
+package handlers
+
+import (
+	"bytes"
+	"net/http"
+
+	"github.com/gorilla/mux"
+	"github.com/seaweedfs/seaweedfs/weed/admin/dash"
+	adminplugin "github.com/seaweedfs/seaweedfs/weed/admin/plugin"
+	"github.com/seaweedfs/seaweedfs/weed/admin/view/app"
+	"github.com/seaweedfs/seaweedfs/weed/admin/view/layout"
+)
+
+// PluginHandlers handles plugin UI pages.
+type PluginHandlers struct {
+	adminServer *dash.AdminServer
+}
+
+// NewPluginHandlers creates a new instance of PluginHandlers.
+func NewPluginHandlers(adminServer *dash.AdminServer) *PluginHandlers {
+	return &PluginHandlers{
+		adminServer: adminServer,
+	}
+}
+
+// ShowPlugin displays plugin overview page.
+func (h *PluginHandlers) ShowPlugin(w http.ResponseWriter, r *http.Request) {
+	h.renderPluginPage(w, r, "overview")
+}
+
+// ShowPluginConfiguration displays plugin configuration page.
+func (h *PluginHandlers) ShowPluginConfiguration(w http.ResponseWriter, r *http.Request) {
+	h.renderPluginPage(w, r, "configuration")
+}
+
+// ShowPluginDetection displays plugin detection jobs page.
+func (h *PluginHandlers) ShowPluginDetection(w http.ResponseWriter, r *http.Request) {
+	h.renderPluginPage(w, r, "detection")
+}
+
+// ShowPluginQueue displays plugin job queue page.
+func (h *PluginHandlers) ShowPluginQueue(w http.ResponseWriter, r *http.Request) {
+	h.renderPluginPage(w, r, "queue")
+}
+
+// ShowPluginExecution displays plugin execution jobs page.
+func (h *PluginHandlers) ShowPluginExecution(w http.ResponseWriter, r *http.Request) {
+	h.renderPluginPage(w, r, "execution")
+}
+
+// ShowPluginMonitoring displays plugin monitoring page.
+func (h *PluginHandlers) ShowPluginMonitoring(w http.ResponseWriter, r *http.Request) {
+	// Backward-compatible alias for the old monitoring URL.
+	h.renderPluginPage(w, r, "detection")
+}
+
+// ShowPluginLane displays a lane overview page using the shared plugin UI.
+func (h *PluginHandlers) ShowPluginLane(w http.ResponseWriter, r *http.Request) {
+	h.renderPluginPageWithLane(w, r, "overview")
+}
+
+// ShowPluginLaneConfiguration displays a lane-specific configuration page.
+func (h *PluginHandlers) ShowPluginLaneConfiguration(w http.ResponseWriter, r *http.Request) {
+	h.renderPluginPageWithLane(w, r, "configuration")
+}
+
+// ShowPluginLaneQueue displays a lane-specific queue page.
+func (h *PluginHandlers) ShowPluginLaneQueue(w http.ResponseWriter, r *http.Request) {
+	h.renderPluginPageWithLane(w, r, "queue")
+}
+
+// ShowPluginLaneDetection displays a lane-specific detection page.
+func (h *PluginHandlers) ShowPluginLaneDetection(w http.ResponseWriter, r *http.Request) {
+	h.renderPluginPageWithLane(w, r, "detection")
+}
+
+// ShowPluginLaneExecution displays a lane-specific execution page.
+func (h *PluginHandlers) ShowPluginLaneExecution(w http.ResponseWriter, r *http.Request) {
+	h.renderPluginPageWithLane(w, r, "execution")
+}
+
+// ShowPluginLaneMonitoring displays a lane-specific monitoring page.
+func (h *PluginHandlers) ShowPluginLaneMonitoring(w http.ResponseWriter, r *http.Request) {
+	// Backward-compatible alias for the old monitoring URL.
+	h.renderPluginPageWithLane(w, r, "detection")
+}
+
+// ShowPluginLaneWorkers displays workers filtered to a specific scheduler lane.
+func (h *PluginHandlers) ShowPluginLaneWorkers(w http.ResponseWriter, r *http.Request) {
+	// Backward-compatible alias for the old lane overview URL.
+	h.renderPluginPageWithLane(w, r, "overview")
+}
+
+func (h *PluginHandlers) renderPluginPageWithLane(w http.ResponseWriter, r *http.Request, page string) {
+	initialJob := r.URL.Query().Get("job")
+	lane := mux.Vars(r)["lane"]
+	component := app.Plugin(page, initialJob, lane)
+	viewCtx := layout.NewViewContext(r, dash.UsernameFromContext(r.Context()), dash.CSRFTokenFromContext(r.Context()))
+	layoutComponent := layout.Layout(viewCtx, component)
+
+	var buf bytes.Buffer
+	if err := layoutComponent.Render(r.Context(), &buf); err != nil {
+		writeJSONError(w, http.StatusInternalServerError, "Failed to render template: "+err.Error())
+		return
+	}
+
+	w.Header().Set("Content-Type", "text/html; charset=utf-8")
+	w.WriteHeader(http.StatusOK)
+	_, _ = w.Write(buf.Bytes())
+}
+
+func (h *PluginHandlers) renderPluginPage(w http.ResponseWriter, r *http.Request, page string) {
+	initialJob := r.URL.Query().Get("job")
+	lane := r.URL.Query().Get("lane")
+	if lane == "" && initialJob != "" {
+		// Derive lane from job type so that e.g. ?job=iceberg_maintenance
+		// scopes the page to the iceberg lane automatically.
+		lane = string(adminplugin.JobTypeLane(initialJob))
+	}
+	if lane == "" {
+		lane = "default"
+	}
+	component := app.Plugin(page, initialJob, lane)
+	viewCtx := layout.NewViewContext(r, dash.UsernameFromContext(r.Context()), dash.CSRFTokenFromContext(r.Context()))
+	layoutComponent := layout.Layout(viewCtx, component)
+
+	var buf bytes.Buffer
+	if err := layoutComponent.Render(r.Context(), &buf); err != nil {
+		writeJSONError(w, http.StatusInternalServerError, "Failed to render template: "+err.Error())
+		return
+	}
+
+	w.Header().Set("Content-Type", "text/html; charset=utf-8")
+	w.WriteHeader(http.StatusOK)
+	_, _ = w.Write(buf.Bytes())
+}

weed/admin/handlers/policy_handlers.go

@@ -0,0 +1,294 @@
+package handlers
+
+import (
+	"errors"
+	"fmt"
+	"net/http"
+	"time"
+
+	"github.com/gorilla/mux"
+	"github.com/seaweedfs/seaweedfs/weed/admin/dash"
+	"github.com/seaweedfs/seaweedfs/weed/admin/view/app"
+	"github.com/seaweedfs/seaweedfs/weed/admin/view/layout"
+	"github.com/seaweedfs/seaweedfs/weed/glog"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/policy_engine"
+)
+
+// PolicyHandlers contains all the HTTP handlers for policy management
+type PolicyHandlers struct {
+	adminServer *dash.AdminServer
+}
+
+// NewPolicyHandlers creates a new instance of PolicyHandlers
+func NewPolicyHandlers(adminServer *dash.AdminServer) *PolicyHandlers {
+	return &PolicyHandlers{
+		adminServer: adminServer,
+	}
+}
+
+// ShowPolicies renders the policies management page
+func (h *PolicyHandlers) ShowPolicies(w http.ResponseWriter, r *http.Request) {
+	// Get policies data from the server
+	policiesData := h.getPoliciesData(r)
+
+	// Render HTML template
+	w.Header().Set("Content-Type", "text/html")
+	policiesComponent := app.Policies(policiesData)
+	viewCtx := layout.NewViewContext(r, dash.UsernameFromContext(r.Context()), dash.CSRFTokenFromContext(r.Context()))
+	layoutComponent := layout.Layout(viewCtx, policiesComponent)
+	if err := layoutComponent.Render(r.Context(), w); err != nil {
+		writeJSONError(w, http.StatusInternalServerError, "Failed to render template: "+err.Error())
+		return
+	}
+}
+
+// GetPolicies returns the list of policies as JSON
+func (h *PolicyHandlers) GetPolicies(w http.ResponseWriter, r *http.Request) {
+	policies, err := h.adminServer.GetPolicies()
+	if err != nil {
+		writeJSONError(w, http.StatusInternalServerError, "Failed to get policies: "+err.Error())
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]interface{}{"policies": policies})
+}
+
+// GetPrincipalSuggestions returns candidate ARNs (existing users and IAM
+// roles) for the policy editor's Principal/NotPrincipal autocomplete.
+func (h *PolicyHandlers) GetPrincipalSuggestions(w http.ResponseWriter, r *http.Request) {
+	suggestions, err := h.adminServer.GetPrincipalSuggestions(r.Context())
+	if err != nil {
+		writeJSONError(w, http.StatusInternalServerError, "Failed to get principal suggestions: "+err.Error())
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]interface{}{"principals": suggestions})
+}
+
+// CreatePolicy handles policy creation
+func (h *PolicyHandlers) CreatePolicy(w http.ResponseWriter, r *http.Request) {
+	var req dash.CreatePolicyRequest
+	if err := decodeJSONBody(newJSONMaxReader(w, r), &req); err != nil {
+		writeJSONError(w, http.StatusBadRequest, "Invalid request: "+err.Error())
+		return
+	}
+
+	// Validate policy name
+	if req.Name == "" {
+		writeJSONError(w, http.StatusBadRequest, "Policy name is required")
+		return
+	}
+
+	// Check if policy already exists
+	existingPolicy, err := h.adminServer.GetPolicy(req.Name)
+	if err != nil {
+		writeJSONError(w, http.StatusInternalServerError, "Failed to check existing policy: "+err.Error())
+		return
+	}
+	if existingPolicy != nil {
+		writeJSONError(w, http.StatusConflict, "Policy with this name already exists")
+		return
+	}
+
+	// Create the policy
+	err = h.adminServer.CreatePolicy(req.Name, req.Document)
+	if err != nil {
+		glog.Errorf("Failed to create policy %s: %v", req.Name, err)
+		writeJSONError(w, http.StatusInternalServerError, "Failed to create policy: "+err.Error())
+		return
+	}
+
+	writeJSON(w, http.StatusCreated, map[string]interface{}{
+		"success": true,
+		"message": "Policy created successfully",
+		"policy":  req.Name,
+	})
+}
+
+// GetPolicy returns a specific policy
+func (h *PolicyHandlers) GetPolicy(w http.ResponseWriter, r *http.Request) {
+	policyName := mux.Vars(r)["name"]
+	if policyName == "" {
+		writeJSONError(w, http.StatusBadRequest, "Policy name is required")
+		return
+	}
+
+	policy, err := h.adminServer.GetPolicy(policyName)
+	if err != nil {
+		writeJSONError(w, http.StatusInternalServerError, "Failed to get policy: "+err.Error())
+		return
+	}
+
+	if policy == nil {
+		writeJSONError(w, http.StatusNotFound, "Policy not found")
+		return
+	}
+
+	writeJSON(w, http.StatusOK, policy)
+}
+
+// UpdatePolicy handles policy updates
+func (h *PolicyHandlers) UpdatePolicy(w http.ResponseWriter, r *http.Request) {
+	policyName := mux.Vars(r)["name"]
+	if policyName == "" {
+		writeJSONError(w, http.StatusBadRequest, "Policy name is required")
+		return
+	}
+
+	var req dash.UpdatePolicyRequest
+	if err := decodeJSONBody(newJSONMaxReader(w, r), &req); err != nil {
+		writeJSONError(w, http.StatusBadRequest, "Invalid request: "+err.Error())
+		return
+	}
+
+	// Check if policy exists
+	existingPolicy, err := h.adminServer.GetPolicy(policyName)
+	if err != nil {
+		writeJSONError(w, http.StatusInternalServerError, "Failed to check existing policy: "+err.Error())
+		return
+	}
+	if existingPolicy == nil {
+		writeJSONError(w, http.StatusNotFound, "Policy not found")
+		return
+	}
+
+	// Update the policy
+	err = h.adminServer.UpdatePolicy(policyName, req.Document)
+	if err != nil {
+		glog.Errorf("Failed to update policy %s: %v", policyName, err)
+		writeJSONError(w, http.StatusInternalServerError, "Failed to update policy: "+err.Error())
+		return
+	}
+
+	writeJSON(w, http.StatusOK, map[string]interface{}{
+		"success": true,
+		"message": "Policy updated successfully",
+		"policy":  policyName,
+	})
+}
+
+// DeletePolicy handles policy deletion
+func (h *PolicyHandlers) DeletePolicy(w http.ResponseWriter, r *http.Request) {
+	policyName := mux.Vars(r)["name"]
+	if policyName == "" {
+		writeJSONError(w, http.StatusBadRequest, "Policy name is required")
+		return
+	}
+
+	// Check if policy exists
+	existingPolicy, err := h.adminServer.GetPolicy(policyName)
+	if err != nil {
+		writeJSONError(w, http.StatusInternalServerError, "Failed to check existing policy: "+err.Error())
+		return
+	}
+	if existingPolicy == nil {
+		writeJSONError(w, http.StatusNotFound, "Policy not found")
+		return
+	}
+
+	// Delete the policy
+	err = h.adminServer.DeletePolicy(policyName)
+	if err != nil {
+		status := http.StatusInternalServerError
+		if errors.Is(err, dash.ErrPolicyStillAttached) {
+			status = http.StatusConflict
+		} else {
+			glog.Errorf("Failed to delete policy %s: %v", policyName, err)
+		}
+		writeJSONError(w, status, "Failed to delete policy: "+err.Error())
+		return
+	}
+
+	writeJSON(w, http.StatusOK, map[string]interface{}{
+		"success": true,
+		"message": "Policy deleted successfully",
+		"policy":  policyName,
+	})
+}
+
+// ValidatePolicy validates a policy document without saving it
+func (h *PolicyHandlers) ValidatePolicy(w http.ResponseWriter, r *http.Request) {
+	var req struct {
+		Document policy_engine.PolicyDocument `json:"document"`
+	}
+
+	if err := decodeJSONBody(newJSONMaxReader(w, r), &req); err != nil {
+		writeJSONError(w, http.StatusBadRequest, "Invalid request: "+err.Error())
+		return
+	}
+
+	// Basic validation
+	if req.Document.Version == "" {
+		writeJSONError(w, http.StatusBadRequest, "Policy version is required")
+		return
+	}
+
+	if len(req.Document.Statement) == 0 {
+		writeJSONError(w, http.StatusBadRequest, "Policy must have at least one statement")
+		return
+	}
+
+	// Validate each statement
+	for i, statement := range req.Document.Statement {
+		if statement.Effect != "Allow" && statement.Effect != "Deny" {
+			writeJSONError(w, http.StatusBadRequest, fmt.Sprintf("Statement %d: Effect must be 'Allow' or 'Deny'", i+1))
+			return
+		}
+
+		if len(statement.Action.Strings()) == 0 {
+			writeJSONError(w, http.StatusBadRequest, fmt.Sprintf("Statement %d: Action is required", i+1))
+			return
+		}
+
+		if len(statement.Resource.Strings()) == 0 && len(statement.NotResource.Strings()) == 0 {
+			writeJSONError(w, http.StatusBadRequest, fmt.Sprintf("Statement %d: Resource or NotResource is required", i+1))
+			return
+		}
+
+		if statement.Resource != nil && statement.NotResource != nil {
+			writeJSONError(w, http.StatusBadRequest, fmt.Sprintf("Statement %d: cannot specify both Resource and NotResource", i+1))
+			return
+		}
+
+		if statement.Principal != nil && statement.NotPrincipal != nil {
+			writeJSONError(w, http.StatusBadRequest, fmt.Sprintf("Statement %d: cannot specify both Principal and NotPrincipal", i+1))
+			return
+		}
+	}
+
+	writeJSON(w, http.StatusOK, map[string]interface{}{
+		"valid":   true,
+		"message": "Policy document is valid",
+	})
+}
+
+// getPoliciesData retrieves policies data from the server
+func (h *PolicyHandlers) getPoliciesData(r *http.Request) dash.PoliciesData {
+	username := dash.UsernameFromContext(r.Context())
+	if username == "" {
+		username = "admin"
+	}
+
+	// Get policies
+	policies, err := h.adminServer.GetPolicies()
+	if err != nil {
+		glog.Errorf("Failed to get policies: %v", err)
+		// Return empty data on error
+		return dash.PoliciesData{
+			Username:      username,
+			Policies:      []dash.IAMPolicy{},
+			TotalPolicies: 0,
+			LastUpdated:   time.Now(),
+		}
+	}
+
+	// Ensure policies is never nil
+	if policies == nil {
+		policies = []dash.IAMPolicy{}
+	}
+
+	return dash.PoliciesData{
+		Username:      username,
+		Policies:      policies,
+		TotalPolicies: len(policies),
+		LastUpdated:   time.Now(),
+	}
+}

weed/admin/handlers/policy_handlers_test.go

@@ -0,0 +1,161 @@
+package handlers
+
+import (
+	"bytes"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/admin/dash"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/policy_engine"
+)
+
+func newValidatePolicyRequest(t *testing.T, document map[string]interface{}) *http.Request {
+	t.Helper()
+	body, err := json.Marshal(map[string]interface{}{"document": document})
+	if err != nil {
+		t.Fatalf("failed to marshal request body: %v", err)
+	}
+	req := httptest.NewRequest(http.MethodPost, "/api/object-store/policies/validate", bytes.NewReader(body))
+	req.Header.Set("Content-Type", "application/json")
+	return req
+}
+
+func TestValidatePolicy(t *testing.T) {
+	handlers := &PolicyHandlers{adminServer: &dash.AdminServer{}}
+
+	tests := []struct {
+		name       string
+		document   map[string]interface{}
+		wantStatus int
+	}{
+		{
+			name: "valid document with Resource",
+			document: map[string]interface{}{
+				"Version": "2012-10-17",
+				"Statement": []map[string]interface{}{
+					{"Effect": "Allow", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::my-bucket/*"},
+				},
+			},
+			wantStatus: http.StatusOK,
+		},
+		{
+			name: "valid document with NotResource only",
+			document: map[string]interface{}{
+				"Version": "2012-10-17",
+				"Statement": []map[string]interface{}{
+					{"Effect": "Allow", "Action": "s3:GetObject", "NotResource": "arn:aws:s3:::secret-bucket/*"},
+				},
+			},
+			wantStatus: http.StatusOK,
+		},
+		{
+			name: "missing version",
+			document: map[string]interface{}{
+				"Statement": []map[string]interface{}{
+					{"Effect": "Allow", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::my-bucket/*"},
+				},
+			},
+			wantStatus: http.StatusBadRequest,
+		},
+		{
+			name: "no statements",
+			document: map[string]interface{}{
+				"Version":   "2012-10-17",
+				"Statement": []map[string]interface{}{},
+			},
+			wantStatus: http.StatusBadRequest,
+		},
+		{
+			name: "invalid effect",
+			document: map[string]interface{}{
+				"Version": "2012-10-17",
+				"Statement": []map[string]interface{}{
+					{"Effect": "Maybe", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::my-bucket/*"},
+				},
+			},
+			wantStatus: http.StatusBadRequest,
+		},
+		{
+			name: "missing action",
+			document: map[string]interface{}{
+				"Version": "2012-10-17",
+				"Statement": []map[string]interface{}{
+					{"Effect": "Allow", "Resource": "arn:aws:s3:::my-bucket/*"},
+				},
+			},
+			wantStatus: http.StatusBadRequest,
+		},
+		{
+			name: "neither Resource nor NotResource",
+			document: map[string]interface{}{
+				"Version": "2012-10-17",
+				"Statement": []map[string]interface{}{
+					{"Effect": "Allow", "Action": "s3:GetObject"},
+				},
+			},
+			wantStatus: http.StatusBadRequest,
+		},
+		{
+			name: "both Resource and NotResource",
+			document: map[string]interface{}{
+				"Version": "2012-10-17",
+				"Statement": []map[string]interface{}{
+					{"Effect": "Allow", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::my-bucket/*", "NotResource": "arn:aws:s3:::secret-bucket/*"},
+				},
+			},
+			wantStatus: http.StatusBadRequest,
+		},
+		{
+			name: "empty Resource alongside non-empty NotResource is still a conflict",
+			document: map[string]interface{}{
+				"Version": "2012-10-17",
+				"Statement": []map[string]interface{}{
+					{"Effect": "Allow", "Action": "s3:GetObject", "Resource": []string{}, "NotResource": "arn:aws:s3:::secret-bucket/*"},
+				},
+			},
+			wantStatus: http.StatusBadRequest,
+		},
+		{
+			name: "both Principal and NotPrincipal",
+			document: map[string]interface{}{
+				"Version": "2012-10-17",
+				"Statement": []map[string]interface{}{
+					{"Effect": "Allow", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::my-bucket/*", "Principal": "*", "NotPrincipal": "arn:aws:iam::123456789012:user/bob"},
+				},
+			},
+			wantStatus: http.StatusBadRequest,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			req := newValidatePolicyRequest(t, tt.document)
+			w := httptest.NewRecorder()
+
+			handlers.ValidatePolicy(w, req)
+
+			if w.Code != tt.wantStatus {
+				t.Fatalf("expected status %d, got %d (body: %s)", tt.wantStatus, w.Code, w.Body.String())
+			}
+		})
+	}
+}
+
+// Sanity check that policy_engine.PolicyStatement (the type ValidatePolicy
+// actually decodes into) round-trips NotResource-only statements the way the
+// test above assumes.
+func TestValidatePolicy_NotResourceOnlyDecodes(t *testing.T) {
+	raw := []byte(`{"Effect":"Allow","Action":"s3:GetObject","NotResource":"arn:aws:s3:::secret/*"}`)
+	var stmt policy_engine.PolicyStatement
+	if err := json.Unmarshal(raw, &stmt); err != nil {
+		t.Fatalf("failed to unmarshal statement: %v", err)
+	}
+	if len(stmt.Resource.Strings()) != 0 {
+		t.Fatalf("expected no Resource, got %v", stmt.Resource.Strings())
+	}
+	if len(stmt.NotResource.Strings()) != 1 {
+		t.Fatalf("expected exactly one NotResource entry, got %v", stmt.NotResource.Strings())
+	}
+}

weed/admin/handlers/service_account_handlers.go

@@ -0,0 +1,214 @@
+package handlers
+
+import (
+	"bytes"
+	"errors"
+	"net/http"
+	"time"
+
+	"github.com/gorilla/mux"
+	"github.com/seaweedfs/seaweedfs/weed/admin/dash"
+	"github.com/seaweedfs/seaweedfs/weed/admin/view/app"
+	"github.com/seaweedfs/seaweedfs/weed/admin/view/layout"
+	"github.com/seaweedfs/seaweedfs/weed/glog"
+)
+
+// ServiceAccountHandlers contains HTTP handlers for service account management
+type ServiceAccountHandlers struct {
+	adminServer *dash.AdminServer
+}
+
+// NewServiceAccountHandlers creates a new instance of ServiceAccountHandlers
+func NewServiceAccountHandlers(adminServer *dash.AdminServer) *ServiceAccountHandlers {
+	return &ServiceAccountHandlers{
+		adminServer: adminServer,
+	}
+}
+
+// ShowServiceAccounts renders the service accounts management page
+func (h *ServiceAccountHandlers) ShowServiceAccounts(w http.ResponseWriter, r *http.Request) {
+	data := h.getServiceAccountsData(r)
+
+	// Render to buffer first to avoid partial writes on error
+	var buf bytes.Buffer
+	component := app.ServiceAccounts(data)
+	viewCtx := layout.NewViewContext(r, dash.UsernameFromContext(r.Context()), dash.CSRFTokenFromContext(r.Context()))
+	layoutComponent := layout.Layout(viewCtx, component)
+	err := layoutComponent.Render(r.Context(), &buf)
+	if err != nil {
+		glog.Errorf("Failed to render service accounts template: %v", err)
+		w.WriteHeader(http.StatusInternalServerError)
+		return
+	}
+
+	// Only write to response if render succeeded
+	w.Header().Set("Content-Type", "text/html")
+	_, _ = w.Write(buf.Bytes())
+}
+
+// GetServiceAccounts returns the list of service accounts as JSON
+func (h *ServiceAccountHandlers) GetServiceAccounts(w http.ResponseWriter, r *http.Request) {
+	parentUser := r.URL.Query().Get("parent_user")
+
+	accounts, err := h.adminServer.GetServiceAccounts(r.Context(), parentUser)
+	if err != nil {
+		glog.Errorf("Failed to get service accounts: %v", err)
+		writeJSONError(w, http.StatusInternalServerError, "Failed to get service accounts")
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]interface{}{"service_accounts": accounts})
+}
+
+// CreateServiceAccount handles service account creation
+func (h *ServiceAccountHandlers) CreateServiceAccount(w http.ResponseWriter, r *http.Request) {
+	var req dash.CreateServiceAccountRequest
+	if err := decodeJSONBody(newJSONMaxReader(w, r), &req); err != nil {
+		writeJSONError(w, http.StatusBadRequest, "Invalid request: "+err.Error())
+		return
+	}
+
+	if req.ParentUser == "" {
+		writeJSONError(w, http.StatusBadRequest, "ParentUser is required")
+		return
+	}
+
+	sa, err := h.adminServer.CreateServiceAccount(r.Context(), req)
+	if err != nil {
+		glog.Errorf("Failed to create service account for user %s: %v", req.ParentUser, err)
+		writeJSONError(w, http.StatusInternalServerError, "Failed to create service account")
+		return
+	}
+
+	writeJSON(w, http.StatusCreated, map[string]interface{}{
+		"message":         "Service account created successfully",
+		"service_account": sa,
+	})
+}
+
+// GetServiceAccountDetails returns detailed information about a service account
+func (h *ServiceAccountHandlers) GetServiceAccountDetails(w http.ResponseWriter, r *http.Request) {
+	id := mux.Vars(r)["id"]
+	if id == "" {
+		writeJSONError(w, http.StatusBadRequest, "Service account ID is required")
+		return
+	}
+
+	sa, err := h.adminServer.GetServiceAccountDetails(r.Context(), id)
+	if err != nil {
+		// Distinguish not-found errors from internal errors
+		if errors.Is(err, dash.ErrServiceAccountNotFound) {
+			writeJSONError(w, http.StatusNotFound, "Service account not found: "+err.Error())
+		} else {
+			glog.Errorf("Failed to get service account details for %s: %v", id, err)
+			writeJSONError(w, http.StatusInternalServerError, "Failed to get service account details")
+		}
+		return
+	}
+
+	writeJSON(w, http.StatusOK, sa)
+}
+
+// UpdateServiceAccount handles service account updates
+func (h *ServiceAccountHandlers) UpdateServiceAccount(w http.ResponseWriter, r *http.Request) {
+	id := mux.Vars(r)["id"]
+	if id == "" {
+		writeJSONError(w, http.StatusBadRequest, "Service account ID is required")
+		return
+	}
+
+	var req dash.UpdateServiceAccountRequest
+	if err := decodeJSONBody(newJSONMaxReader(w, r), &req); err != nil {
+		writeJSONError(w, http.StatusBadRequest, "Invalid request: "+err.Error())
+		return
+	}
+
+	sa, err := h.adminServer.UpdateServiceAccount(r.Context(), id, req)
+	if err != nil {
+		// Distinguish not-found errors from internal errors
+		if errors.Is(err, dash.ErrServiceAccountNotFound) {
+			writeJSONError(w, http.StatusNotFound, "Service account not found")
+		} else {
+			glog.Errorf("Failed to update service account %s: %v", id, err)
+			writeJSONError(w, http.StatusInternalServerError, "Failed to update service account")
+		}
+		return
+	}
+
+	writeJSON(w, http.StatusOK, map[string]interface{}{
+		"message":         "Service account updated successfully",
+		"service_account": sa,
+	})
+}
+
+// DeleteServiceAccount handles service account deletion
+func (h *ServiceAccountHandlers) DeleteServiceAccount(w http.ResponseWriter, r *http.Request) {
+	id := mux.Vars(r)["id"]
+	if id == "" {
+		writeJSONError(w, http.StatusBadRequest, "Service account ID is required")
+		return
+	}
+
+	err := h.adminServer.DeleteServiceAccount(r.Context(), id)
+	if err != nil {
+		// Distinguish not-found errors from internal errors
+		if errors.Is(err, dash.ErrServiceAccountNotFound) {
+			writeJSONError(w, http.StatusNotFound, "Service account not found")
+		} else {
+			glog.Errorf("Failed to delete service account %s: %v", id, err)
+			writeJSONError(w, http.StatusInternalServerError, "Failed to delete service account")
+		}
+		return
+	}
+
+	writeJSON(w, http.StatusOK, map[string]interface{}{
+		"message": "Service account deleted successfully",
+	})
+}
+
+// getServiceAccountsData retrieves service accounts data for the template
+func (h *ServiceAccountHandlers) getServiceAccountsData(r *http.Request) dash.ServiceAccountsData {
+	username := dash.UsernameFromContext(r.Context())
+	if username == "" {
+		username = "admin"
+	}
+
+	// Get all service accounts
+	accounts, err := h.adminServer.GetServiceAccounts(r.Context(), "")
+	if err != nil {
+		glog.Errorf("Failed to get service accounts: %v", err)
+		return dash.ServiceAccountsData{
+			Username:        username,
+			ServiceAccounts: []dash.ServiceAccount{},
+			TotalAccounts:   0,
+			LastUpdated:     time.Now(),
+		}
+	}
+
+	// Count active accounts
+	activeCount := 0
+	for _, sa := range accounts {
+		if sa.Status == dash.StatusActive {
+			activeCount++
+		}
+	}
+
+	// Get available users for dropdown
+	var availableUsers []string
+	users, err := h.adminServer.GetObjectStoreUsers(r.Context())
+	if err != nil {
+		glog.Errorf("Failed to get users for dropdown: %v", err)
+	} else {
+		for _, user := range users {
+			availableUsers = append(availableUsers, user.Username)
+		}
+	}
+
+	return dash.ServiceAccountsData{
+		Username:        username,
+		ServiceAccounts: accounts,
+		TotalAccounts:   len(accounts),
+		ActiveAccounts:  activeCount,
+		AvailableUsers:  availableUsers,
+		LastUpdated:     time.Now(),
+	}
+}

weed/admin/handlers/task_config_interface.go

@@ -0,0 +1,25 @@
+package handlers
+
+import (
+	"github.com/seaweedfs/seaweedfs/weed/admin/config"
+	"github.com/seaweedfs/seaweedfs/weed/pb/worker_pb"
+)
+
+// TaskConfig defines the interface that all task configuration types must implement
+type TaskConfig interface {
+	config.ConfigWithDefaults // Extends ConfigWithDefaults for type-safe schema operations
+
+	// Common methods from BaseConfig
+	IsEnabled() bool
+	SetEnabled(enabled bool)
+
+	// Protobuf serialization methods - no more map[string]interface{}!
+	ToTaskPolicy() *worker_pb.TaskPolicy
+	FromTaskPolicy(policy *worker_pb.TaskPolicy) error
+}
+
+// TaskConfigProvider defines the interface for creating specific task config types
+type TaskConfigProvider interface {
+	NewConfig() TaskConfig
+	GetTaskType() string
+}

weed/admin/handlers/user_handlers.go

@@ -0,0 +1,362 @@
+package handlers
+
+import (
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"time"
+
+	"github.com/gorilla/mux"
+	"github.com/seaweedfs/seaweedfs/weed/admin/dash"
+	"github.com/seaweedfs/seaweedfs/weed/admin/view/app"
+	"github.com/seaweedfs/seaweedfs/weed/admin/view/layout"
+	"github.com/seaweedfs/seaweedfs/weed/glog"
+)
+
+// UserHandlers contains all the HTTP handlers for user management
+type UserHandlers struct {
+	adminServer *dash.AdminServer
+}
+
+// NewUserHandlers creates a new instance of UserHandlers
+func NewUserHandlers(adminServer *dash.AdminServer) *UserHandlers {
+	return &UserHandlers{
+		adminServer: adminServer,
+	}
+}
+
+// ShowObjectStoreUsers renders the object store users management page
+func (h *UserHandlers) ShowObjectStoreUsers(w http.ResponseWriter, r *http.Request) {
+	// Get object store users data from the server
+	usersData := h.getObjectStoreUsersData(r)
+
+	// Render HTML template
+	// Add cache-control headers to prevent browser caching of inline JavaScript
+	w.Header().Set("Content-Type", "text/html")
+	w.Header().Set("Cache-Control", "no-cache, no-store, must-revalidate")
+	w.Header().Set("Pragma", "no-cache")
+	w.Header().Set("Expires", "0")
+	w.Header().Set("ETag", fmt.Sprintf("\"%d\"", time.Now().Unix()))
+	usersComponent := app.ObjectStoreUsers(usersData)
+	viewCtx := layout.NewViewContext(r, dash.UsernameFromContext(r.Context()), dash.CSRFTokenFromContext(r.Context()))
+	layoutComponent := layout.Layout(viewCtx, usersComponent)
+	err := layoutComponent.Render(r.Context(), w)
+	if err != nil {
+		writeJSONError(w, http.StatusInternalServerError, "Failed to render template: "+err.Error())
+		return
+	}
+}
+
+// GetUsers returns the list of users as JSON
+func (h *UserHandlers) GetUsers(w http.ResponseWriter, r *http.Request) {
+	users, err := h.adminServer.GetObjectStoreUsers(r.Context())
+	if err != nil {
+		writeJSONError(w, http.StatusInternalServerError, "Failed to get users: "+err.Error())
+		return
+	}
+	// Read-only (view-only) admin sessions must never receive reusable
+	// object-store secrets. Redact the secret key before serializing so a
+	// viewer cannot lift another user's live S3 credential pair.
+	if dash.IsReadOnlyRole(dash.RoleFromContext(r.Context())) {
+		for i := range users {
+			users[i].RedactSecretKey()
+		}
+	}
+	writeJSON(w, http.StatusOK, map[string]interface{}{"users": users})
+}
+
+// CreateUser handles user creation
+func (h *UserHandlers) CreateUser(w http.ResponseWriter, r *http.Request) {
+	var req dash.CreateUserRequest
+	if err := decodeJSONBody(newJSONMaxReader(w, r), &req); err != nil {
+		writeJSONError(w, http.StatusBadRequest, "Invalid request: "+err.Error())
+		return
+	}
+
+	// Validate required fields
+	if req.Username == "" {
+		writeJSONError(w, http.StatusBadRequest, "Username is required")
+		return
+	}
+
+	user, err := h.adminServer.CreateObjectStoreUser(req)
+	if err != nil {
+		glog.Errorf("Failed to create user %s: %v", req.Username, err)
+		writeJSONError(w, http.StatusInternalServerError, "Failed to create user: "+err.Error())
+		return
+	}
+
+	writeJSON(w, http.StatusCreated, map[string]interface{}{
+		"message": "User created successfully",
+		"user":    user,
+	})
+}
+
+// UpdateUser handles user updates
+func (h *UserHandlers) UpdateUser(w http.ResponseWriter, r *http.Request) {
+	username := mux.Vars(r)["username"]
+	if username == "" {
+		writeJSONError(w, http.StatusBadRequest, "Username is required")
+		return
+	}
+
+	if h.adminServer.IsStaticUser(username) {
+		writeJSONError(w, http.StatusForbidden, "Cannot modify static user "+username+" (loaded from config file)")
+		return
+	}
+
+	var req dash.UpdateUserRequest
+	if err := decodeJSONBody(newJSONMaxReader(w, r), &req); err != nil {
+		writeJSONError(w, http.StatusBadRequest, "Invalid request: "+err.Error())
+		return
+	}
+
+	user, err := h.adminServer.UpdateObjectStoreUser(username, req)
+	if err != nil {
+		glog.Errorf("Failed to update user %s: %v", username, err)
+		writeJSONError(w, http.StatusInternalServerError, "Failed to update user: "+err.Error())
+		return
+	}
+
+	writeJSON(w, http.StatusOK, map[string]interface{}{
+		"message": "User updated successfully",
+		"user":    user,
+	})
+}
+
+// DeleteUser handles user deletion
+func (h *UserHandlers) DeleteUser(w http.ResponseWriter, r *http.Request) {
+	username := mux.Vars(r)["username"]
+	if username == "" {
+		writeJSONError(w, http.StatusBadRequest, "Username is required")
+		return
+	}
+
+	if h.adminServer.IsStaticUser(username) {
+		writeJSONError(w, http.StatusForbidden, "Cannot delete static user "+username+" (loaded from config file)")
+		return
+	}
+
+	err := h.adminServer.DeleteObjectStoreUser(username)
+	if err != nil {
+		glog.Errorf("Failed to delete user %s: %v", username, err)
+		writeJSONError(w, http.StatusInternalServerError, "Failed to delete user: "+err.Error())
+		return
+	}
+
+	writeJSON(w, http.StatusOK, map[string]interface{}{
+		"message": "User deleted successfully",
+	})
+}
+
+// GetUserDetails returns detailed information about a specific user
+func (h *UserHandlers) GetUserDetails(w http.ResponseWriter, r *http.Request) {
+	username := mux.Vars(r)["username"]
+	if username == "" {
+		writeJSONError(w, http.StatusBadRequest, "Username is required")
+		return
+	}
+
+	user, err := h.adminServer.GetObjectStoreUserDetails(username)
+	if err != nil {
+		writeJSONError(w, http.StatusNotFound, "User not found: "+err.Error())
+		return
+	}
+
+	// Read-only (view-only) admin sessions must never receive reusable
+	// object-store secrets. Redact the secret keys before serializing so a
+	// viewer cannot lift another user's live S3 credential pair.
+	if dash.IsReadOnlyRole(dash.RoleFromContext(r.Context())) {
+		user.RedactSecretKeys()
+	}
+
+	writeJSON(w, http.StatusOK, user)
+}
+
+// CreateAccessKey creates a new access key for a user
+func (h *UserHandlers) CreateAccessKey(w http.ResponseWriter, r *http.Request) {
+	username := mux.Vars(r)["username"]
+	if username == "" {
+		writeJSONError(w, http.StatusBadRequest, "Username is required")
+		return
+	}
+
+	var req *dash.CreateAccessKeyRequest
+	var body dash.CreateAccessKeyRequest
+	if err := decodeJSONBody(newJSONMaxReader(w, r), &body); err != nil {
+		if !errors.Is(err, io.EOF) {
+			writeJSONError(w, http.StatusBadRequest, "Invalid request: "+err.Error())
+			return
+		}
+		// Empty body: auto-generate both keys
+	} else {
+		req = &body
+	}
+
+	accessKey, err := h.adminServer.CreateAccessKey(username, req)
+	if err != nil {
+		glog.Errorf("Failed to create access key for user %s: %v", username, err)
+		if errors.Is(err, dash.ErrAccessKeyInUse) {
+			writeJSONError(w, http.StatusConflict, err.Error())
+		} else if errors.Is(err, dash.ErrUserNotFound) {
+			writeJSONError(w, http.StatusNotFound, err.Error())
+		} else if errors.Is(err, dash.ErrInvalidInput) {
+			writeJSONError(w, http.StatusBadRequest, err.Error())
+		} else {
+			writeJSONError(w, http.StatusInternalServerError, "Failed to create access key: "+err.Error())
+		}
+		return
+	}
+
+	writeJSON(w, http.StatusCreated, map[string]interface{}{
+		"message":    "Access key created successfully",
+		"access_key": accessKey,
+	})
+}
+
+// DeleteAccessKey deletes an access key for a user
+func (h *UserHandlers) DeleteAccessKey(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	username := vars["username"]
+	accessKeyId := vars["accessKeyId"]
+
+	if username == "" || accessKeyId == "" {
+		writeJSONError(w, http.StatusBadRequest, "Username and access key ID are required")
+		return
+	}
+
+	err := h.adminServer.DeleteAccessKey(username, accessKeyId)
+	if err != nil {
+		glog.Errorf("Failed to delete access key %s for user %s: %v", accessKeyId, username, err)
+		writeJSONError(w, http.StatusInternalServerError, "Failed to delete access key: "+err.Error())
+		return
+	}
+
+	writeJSON(w, http.StatusOK, map[string]interface{}{
+		"message": "Access key deleted successfully",
+	})
+}
+
+// UpdateAccessKeyStatus updates the status of an access key for a user
+func (h *UserHandlers) UpdateAccessKeyStatus(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	username := vars["username"]
+	accessKeyId := vars["accessKeyId"]
+
+	if username == "" || accessKeyId == "" {
+		writeJSONError(w, http.StatusBadRequest, "Username and access key ID are required")
+		return
+	}
+
+	var req dash.UpdateAccessKeyStatusRequest
+	if err := decodeJSONBody(newJSONMaxReader(w, r), &req); err != nil {
+		writeJSONError(w, http.StatusBadRequest, "Invalid request: "+err.Error())
+		return
+	}
+
+	// Validate status
+	if req.Status != dash.AccessKeyStatusActive && req.Status != dash.AccessKeyStatusInactive {
+		writeJSONError(w, http.StatusBadRequest, fmt.Sprintf("Status must be '%s' or '%s'", dash.AccessKeyStatusActive, dash.AccessKeyStatusInactive))
+		return
+	}
+
+	err := h.adminServer.UpdateAccessKeyStatus(username, accessKeyId, req.Status)
+	if err != nil {
+		glog.Errorf("Failed to update access key status %s for user %s: %v", accessKeyId, username, err)
+		writeJSONError(w, http.StatusInternalServerError, "Failed to update access key status: "+err.Error())
+		return
+	}
+
+	writeJSON(w, http.StatusOK, map[string]interface{}{
+		"message": "Access key updated successfully",
+	})
+}
+
+// GetUserPolicies returns the policies for a user
+func (h *UserHandlers) GetUserPolicies(w http.ResponseWriter, r *http.Request) {
+	username := mux.Vars(r)["username"]
+	if username == "" {
+		writeJSONError(w, http.StatusBadRequest, "Username is required")
+		return
+	}
+
+	policies, err := h.adminServer.GetUserPolicies(username)
+	if err != nil {
+		writeJSONError(w, http.StatusInternalServerError, "Failed to get user policies: "+err.Error())
+		return
+	}
+
+	writeJSON(w, http.StatusOK, map[string]interface{}{"policies": policies})
+}
+
+// UpdateUserPolicies updates the policies for a user
+func (h *UserHandlers) UpdateUserPolicies(w http.ResponseWriter, r *http.Request) {
+	username := mux.Vars(r)["username"]
+	if username == "" {
+		writeJSONError(w, http.StatusBadRequest, "Username is required")
+		return
+	}
+
+	var req dash.UpdateUserPoliciesRequest
+	if err := decodeJSONBody(newJSONMaxReader(w, r), &req); err != nil {
+		writeJSONError(w, http.StatusBadRequest, "Invalid request: "+err.Error())
+		return
+	}
+
+	err := h.adminServer.UpdateUserPolicies(username, req.Actions)
+	if err != nil {
+		glog.Errorf("Failed to update policies for user %s: %v", username, err)
+		writeJSONError(w, http.StatusInternalServerError, "Failed to update user policies: "+err.Error())
+		return
+	}
+
+	writeJSON(w, http.StatusOK, map[string]interface{}{
+		"message": "User policies updated successfully",
+	})
+}
+
+// getObjectStoreUsersData retrieves object store users data from the server
+func (h *UserHandlers) getObjectStoreUsersData(r *http.Request) dash.ObjectStoreUsersData {
+	username := dash.UsernameFromContext(r.Context())
+	if username == "" {
+		username = "admin"
+	}
+
+	// Get object store users
+	users, err := h.adminServer.GetObjectStoreUsers(r.Context())
+	if err != nil {
+		glog.Errorf("Failed to get object store users: %v", err)
+		// Return empty data on error
+		return dash.ObjectStoreUsersData{
+			Username:    username,
+			Users:       []dash.ObjectStoreUser{},
+			TotalUsers:  0,
+			LastUpdated: time.Now(),
+		}
+	}
+
+	// Read-only (view-only) admin sessions must never receive reusable
+	// object-store secrets, including via the rendered HTML users page.
+	if dash.IsReadOnlyRole(dash.RoleFromContext(r.Context())) {
+		for i := range users {
+			users[i].RedactSecretKey()
+		}
+	}
+
+	hasAnonymous := false
+	for _, u := range users {
+		if u.Username == "anonymous" {
+			hasAnonymous = true
+			break
+		}
+	}
+
+	return dash.ObjectStoreUsersData{
+		Username:         username,
+		Users:            users,
+		TotalUsers:       len(users),
+		HasAnonymousUser: hasAnonymous,
+		LastUpdated:      time.Now(),
+	}
+}